Which versions of Openclaw are affected by CVE-2026-34503?

OpenClaw versions before 2026.3.28 contain a session fixation vulnerability in WebSocket handling that allows unauthenticated attackers to maintain unauthorized access to device communications even…. A patch is available.

How to fix or mitigate CVE-2026-34503?

Within 24 hours: Identify all OpenClaw deployments and their current versions via asset inventory and vendor advisories. Within 7 days: Test vendor-released patch version 2026.3.28 or later in a staging environment and schedule maintenance windows for production systems. Within 30 days: Deploy patched OpenClaw version 2026.3.28 to all affected production instances and verify WebSocket session termination upon credential revocation through functional testing.

Openclaw CVE-2026-34503

Q: What is the CVSS score of CVE-2026-34503?

CVE-2026-34503 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17469 HIGH

Insufficient Session Expiration (CWE-613)

2026-03-31 VulnCheck

GHSA-2pr2-hcv6-7gwv

Authentication Bypass Openclaw

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 14:30 euvd

EUVD-2026-17469

Analysis Generated

Mar 31, 2026 - 14:30 vuln.today

Patch released

Mar 31, 2026 - 14:30 nvd

Patch available

CVE Published

Mar 31, 2026 - 14:10 nvd

HIGH 8.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.28.

DescriptionCVE.org

OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.

AnalysisAI

WebSocket session fixation in OpenClaw before version 2026.3.28 enables attackers to maintain unauthorized access after credential revocation. The vulnerability permits unauthenticated remote attackers (CVSS PR:N) to exploit persistent WebSocket connections that fail to terminate when device tokens are revoked, resulting in high confidentiality impact. No public exploit identified at time of analysis, though the attack vector is network-accessible with low complexity. EPSS data not available; affects OpenClaw deployments with WebSocket-based device communication.

Technical ContextAI

OpenClaw is a device management platform utilizing WebSocket protocol for persistent bidirectional communication with connected devices. This vulnerability stems from CWE-613 (Insufficient Session Expiration), where the session management layer fails to implement proper lifecycle binding between authentication tokens and active WebSocket connections. When administrators revoke device credentials or remove devices from the system, the authentication state changes in the backend database, but the WebSocket session handler does not receive termination signals or perform active validation of token status. The affected component (cpe:2.3:a:openclaw:openclaw) lacks real-time session invalidation mechanisms, allowing stale connections to persist until natural disconnection events (network timeout, client closure, or server restart). This represents a design flaw in the session state synchronization between the authentication subsystem and the WebSocket connection manager.

RemediationAI

Upgrade to OpenClaw version 2026.3.28 or later, which implements proper WebSocket session termination synchronized with credential revocation and device removal events. The vendor-released patch is available through the project's GitHub repository, with the specific fix implemented in commit 7a801cc451e9e667b705eeccff651923a1b8c863 accessible at https://github.com/openclaw/openclaw/commit/7a801cc451e9e667b705eeccff651923a1b8c863. Organizations unable to immediately upgrade should implement compensating controls including forced WebSocket connection cycling via server restarts during credential revocation events, network-level session timeout enforcement through load balancers or API gateways (recommended 5-15 minute maximum session duration), and enhanced monitoring for WebSocket connections associated with recently revoked tokens. Review audit logs for any suspicious activity from devices that were removed or had credentials revoked within the past 90 days to identify potential unauthorized access. Consult the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-2pr2-hcv6-7gwv for deployment-specific guidance and validation procedures.