What is the CVSS score of CVE-2026-28458?

CVE-2026-28458 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Openclaw are affected by CVE-2026-28458?

Openclaw versions up to 2026.2.1 contain a critical authentication bypass vulnerability that could allow unauthorized actors to access sensitive functions without proper credentials.. A patch is available.

How to fix or mitigate CVE-2026-28458?

Within 24 hours: Identify all systems running Openclaw versions up to 2026.2.1 and assess exposure. Within 7 days: Apply the available vendor patch to all affected instances in a staged approach, prioritizing production environments. Within 30 days: Complete patching across all environments including development and testing, verify patch effectiveness, and document remediation completion.

Openclaw CVE-2026-28458

HIGH

Missing Authentication for Critical Function (CWE-306)

2026-03-05 disclosure@vulncheck.com

GHSA-mr32-vwc2-5j6h

Authentication Bypass Information Disclosure Openclaw

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

Patch released

Mar 09, 2026 - 17:28 nvd

Patch available

CVE Published

Mar 05, 2026 - 22:16 nvd

HIGH 8.1

DescriptionCVE.org

OpenClaw version 2026.1.20 prior to 2026.2.1 contains a vulnerability in the Browser Relay (extension must be installed and enabled) /cdp WebSocket endpoint in which it does not require authentication tokens, allowing websites to connect via loopback and access sensitive data. Attackers can exploit this by connecting to ws://127.0.0.1:18792/cdp to steal session cookies and execute JavaScript in other browser tabs.

AnalysisAI

Openclaw versions up to 2026.2.1 is affected by missing authentication for critical function (CVSS 8.1).

Technical ContextAI

This vulnerability (CWE-306: Missing Authentication for Critical Function) affects Openclaw. OpenClaw version 2026.1.20 prior to 2026.2.1 contains a vulnerability in the Browser Relay (extension must be installed and enabled) /cdp WebSocket endpoint in which it does not require authentication tokens, allowing websites to connect via loopback and access sensitive data. Attackers can exploit this by connecting to ws://127.0.0.1:18792/cdp to steal session cookies and execute JavaScript in other browser tabs.