CVE-2026-34503

High CVSS: 8.6

OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.

Vendor

Openclaw

Product

Openclaw

CWE

CWE-613

Yayın Tarihi

2026-03-31 15:16:19

Güncelleme

2026-04-02 12:21:24

Source Identifier

disclosure@vulncheck.com

KEV Date Added

Kategoriler

CWE-613 Openclaw HIGH Openclaw 2026

Referanslar

https://github.com/openclaw/openclaw/commit/7a801cc451e9e667b705eeccff651923a1b8c863 https://github.com/openclaw/openclaw/security/advisories/GHSA-2pr2-hcv6-7gwv https://www.vulncheck.com/advisories/openclaw-incomplete-websocket-session-termination-on-device-removal-and-token-revocation

Benzer Kayıtlar

Medium

CVE-2026-34426

OpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment varia…

Medium

CVE-2026-34504

OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-prov…

Medium

CVE-2026-33580

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication th…

High

CVE-2026-33581

OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbi…

Medium

CVE-2026-33576

OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization.…

High

CVE-2026-33577

OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that…