High, CVSS 8.7npmAmendedPublished
OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure
CVE-2026-32062 · GHSA-mfg5-7q5g-f37j
- Affected
- npm @openclaw/voice-call < 2026.2.22
- Fixed in
- 2026.2.22· Vendor fix available
- Issue
- @openclaw/voice-call (and the bundled copy shipped in openclaw) accepted media-stream WebSocket upgrades before stream validation. In reachable deployments, unauthenticated pre-start sockets could be held open and increase resource pressure. Affected Packages / Versions - openclaw (npm): vulnerable <= 2026.2.21-2, patched in 2026.2.22. - @openclaw/voice-call (npm): vulnerable <= 2026.2.21, patched in 2026.2.22. Technical Details Before this fix, the voice-call media-stream path upgraded sockets first and ran shouldAcceptStream() after a later start frame. This created a pre-auth window where remote clients could hold idle sockets without call/token validation. Impact Availability risk in deployments where the media-stream endpoint is reachable and streaming is enabled. Under sustained abuse, this could consume connection-related resources and degrade service for legitimate streams. Remediation The fix adds layered controls in the media-stream path: - strict pre-start timeout…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.