PT-2026-29265 · Openclaw · Openclaw

Antaisecuritylab · Published 2026-03-31 · Updated 2026-04-01 · CVE-2026-34503

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.28

Description The software does not disconnect active WebSocket sessions when devices are removed or tokens are revoked. This allows attackers with revoked credentials to maintain unauthorized access through existing live sessions until a forced reconnection occurs.

Recommendations Update to version 2026.3.28 or later.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-34503

GHSA-2PR2-HCV6-7GWV

GHSA-89HR-6X2P-8XJV

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/security/advisories/GHSA-2pr2-hcv6-7gwv · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/7a801cc451e9e667b705eeccff651923a1b8c863 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34503 · Security Note
• https://osv.dev/vulnerability/GHSA-2pr2-hcv6-7gwv · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-89hr-6x2p-8xjv · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/TheHackerWire/status/2039227791049449829 · Twitter Post
• https://twitter.com/CVEnew/status/2039004438640070811 · Twitter Post
• https://vulncheck.com/advisories/openclaw-incomplete-websocket-session-termination-on-device-removal-and-token-revocation · Note