OpenClaw's March CVE Flood, ClawJacked Hijacking, and the Security Audit You Should Have Done Yesterday

Analysis

OpenClaw's March 2026 Security Meltdown: Full Incident Breakdown

A clean post-mortem on how OpenClaw went from GitHub darling to the defining agentic AI security case study in under 90 days. If you want one document that explains the full attack surface and why this is structurally different from regular software vulns, this is it.

The Complete OpenClaw Security Threat Landscape for 2026

Aggregates every documented incident, CVE, and attack vector into one reference guide with a 5-layer security stack. The stat that stands out: 36.8% of ClawHub skills flagged as flawed by Snyk, and 1 in 5 contained active backdoors during February 2026.

Security

9 OpenClaw CVEs in 4 Days: What Each One Does and When It Was Patched

A no-fluff table of every CVE disclosed March 18-21, with CVSS scores, affected versions, and patch targets. The standout is CVE-2026-22172 (CVSS 9.9) where a low-priv user can declare themselves admin during the WebSocket handshake and the server just believes them.

ClawJacked: How Any Website Can Silently Take Over Your Local OpenClaw Agent

Oasis Security's technical writeup on the WebSocket hijacking chain that lets a malicious webpage steal your auth token and take full control of your local agent with zero interaction. Update to 2026.2.25 or later immediately if you haven't already.

Tools

OpenClaw Security Audit Checklist: 10 Steps to Harden Your Instance

A practical 10-step hardening checklist covering CVE-2026-25253 patching, skill vetting, auth lockdown, and network exposure. Most of the 42K exposed instances could have been protected in under 30 minutes with this.