CVE-2026-28472
Received Received - Intake

Authentication Bypass in OpenClaw Gateway WebSocket Handshake

Publication date: 2026-03-05

Last updated on: 2026-03-09

Assigner: VulnCheck

Description
OpenClaw versions prior to 2026.2.2 contain a vulnerability in the gateway WebSocket connect handshake in which it allows skipping device identity checks when auth.token is present but not validated. Attackers can connect to the gateway without providing device identity or pairing by exploiting the presence check instead of validation, potentially gaining operator access in vulnerable deployments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-03-05
Last Modified
2026-03-09
Generated
2026-07-06
AI Q&A
2026-03-06
EPSS Evaluated
2026-07-05
NVD
CVE-2026-28472
EUVD
EUVD-2026-9918

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openclaw openclaw to 2026.2.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in OpenClaw versions prior to 2026.2.2 and affects the gateway WebSocket connect handshake process.

Specifically, it allows attackers to bypass device identity checks when an auth.token is present but not properly validated.

As a result, attackers can connect to the gateway without providing device identity or pairing by exploiting the presence check instead of actual validation.

This can potentially grant them operator access in vulnerable deployments.

Impact Analysis

The vulnerability can allow unauthorized attackers to gain operator-level access to the gateway.

This means attackers could potentially control or manipulate the device or system that relies on the OpenClaw gateway.

Such unauthorized access could lead to data breaches, disruption of services, or further exploitation within the affected environment.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28472. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart