PT-2026-23547 · Openclaw · Openclaw

Petr Simecek · Published 2026-02-17 · Updated 2026-03-07 · CVE-2026-28472

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.2

Description The gateway WebSocket connect handshake allows skipping device identity checks when auth.token is present but not validated. Attackers can connect to the gateway without providing device identity or pairing by exploiting the presence check instead of validation, potentially gaining operator access in vulnerable deployments. The issue resides in src/gateway/server/ws-connection/message-handler.ts, where the device-identity requirement could be bypassed based on the presence of a non-empty connectParams.auth.token rather than a validated shared-secret authentication result. The gateway should only be reachable from a trusted network and by trusted users.

Recommendations Versions prior to 2026.2.2 require device-identity skipping to now require validated shared-secret authentication (token/password). Tailscale-authenticated connections without validated shared secret require device identity.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-28472

GHSA-RV39-79C4-7459

Affected Products

Openclaw

References · 12

• https://github.com/openclaw/openclaw/commit/fe81b1d7125a014b8280da461f34efbf5f761575 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-rv39-79c4-7459 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28472 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28472 · Security Note
• https://osv.dev/vulnerability/GHSA-rv39-79c4-7459 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.2 · Note
• https://vulncheck.com/advisories/openclaw-device-identity-check-bypass-in-gateway-websocket-connect-handshake · Note
• https://twitter.com/CveFindCom/status/2029689189873189349 · Twitter Post
• https://twitter.com/CVEnew/status/2030385175452954837 · Twitter Post
• https://t.me/CVEtracker/46491 · Telegram Post
• https://twitter.com/TheHackerWire/status/2029894276784718331 · Twitter Post