What is the CVSS score of CVE-2026-28458?

CVE-2026-28458 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Openclaw are affected by CVE-2026-28458?

Openclaw versions up to 2026.2.1 contain a critical authentication bypass vulnerability that could allow unauthorized actors to access sensitive functions without proper credentials.. A patch is available.

Openclaw CVE-2026-28458

HIGH

Missing Authentication for Critical Function (CWE-306)

2026-03-05 disclosure@vulncheck.com

GHSA-mr32-vwc2-5j6h

Authentication Bypass Information Disclosure Openclaw

8.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

Patch released

Mar 09, 2026 - 17:28 nvd

Patch available

CVE Published

Mar 05, 2026 - 22:16 nvd

HIGH 8.1

DescriptionNVD

OpenClaw version 2026.1.20 prior to 2026.2.1 contains a vulnerability in the Browser Relay (extension must be installed and enabled) /cdp WebSocket endpoint in which it does not require authentication tokens, allowing websites to connect via loopback and access sensitive data. Attackers can exploit this by connecting to ws://127.0.0.1:18792/cdp to steal session cookies and execute JavaScript in other browser tabs.

AnalysisAI

Openclaw versions up to 2026.2.1 is affected by missing authentication for critical function (CVSS 8.1).

RemediationAI

Within 24 hours: Identify all systems running Openclaw versions up to 2026.2.1 and assess exposure. Within 7 days: Apply the available vendor patch to all affected instances in a staged approach, prioritizing production environments. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-28458 vulnerability details – vuln.today

Back