What is the CVSS score of CVE-2026-28485?

CVE-2026-28485 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Openclaw are affected by CVE-2026-28485?

Openclaw versions up to 2026.2.12 contain a critical authentication bypass vulnerability (CVSS 8.4) that could allow unauthorized actors to access sensitive functions without proper credentials.. A patch is available.

How to fix or mitigate CVE-2026-28485?

Within 24 hours: Identify all Openclaw instances and their versions in your environment; assess which systems are internet-facing or accessible from untrusted networks. Within 7 days: Apply vendor patch to all affected Openclaw installations (versions up to 2026.2.12); prioritize internet-facing and production systems first. Within 30 days: Complete patching of all remaining Openclaw deployments and conduct post-patch validation testing.

Openclaw CVE-2026-28485

HIGH

Missing Authentication for Critical Function (CWE-306)

2026-03-05 disclosure@vulncheck.com

Authentication Bypass RCE Openclaw

8.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

Patch released

Mar 11, 2026 - 01:28 nvd

Patch available

CVE Published

Mar 05, 2026 - 22:16 nvd

HIGH 8.4

DescriptionCVE.org

OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized local callers to invoke privileged operations. Remote attackers on the local network or local processes can execute arbitrary browser-context actions and access sensitive in-session data by sending requests to unauthenticated endpoints.

AnalysisAI

Openclaw versions up to 2026.2.12 is affected by missing authentication for critical function (CVSS 8.4).

Technical ContextAI

This vulnerability (CWE-306: Missing Authentication for Critical Function) affects Openclaw. OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized local callers to invoke privileged operations. Remote attackers on the local network or local processes can execute arbitrary browser-context actions and access sensitive in-session data by sending requests to unauthenticated endpoints.