CVE-2026-34503
Persistent Unauthorized Access via WebSocket in OpenClaw Before
Publication date: 2026-03-31
Last updated on: 2026-04-02
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.3.28 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-613 | According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-34503 is a vulnerability in OpenClaw versions before 2026.3.28 where active WebSocket sessions are not properly disconnected when devices are removed or their authentication tokens are revoked.
This means that even after a device's credentials are revoked or the device is removed, any existing live WebSocket sessions associated with that device remain active and connected.
As a result, attackers who have revoked credentials can continue to access the system through these live sessions until the sessions are forcibly reconnected or disconnected.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows attackers with revoked credentials to maintain unauthorized access through existing live WebSocket sessions until forced reconnection. Such unauthorized persistent access can lead to non-compliance with common standards and regulations like GDPR and HIPAA, which require strict access control and timely revocation of access rights to protect sensitive data.
Specifically, failure to properly terminate sessions upon device removal or token revocation can result in prolonged exposure of protected information, violating principles of least privilege and session management mandated by these regulations.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access because revoked credentials do not immediately terminate active sessions.
Attackers or unauthorized users can maintain access to the system through existing WebSocket connections even after their device tokens have been revoked or devices removed.
This extended access increases the risk of data exposure or misuse since the system mistakenly trusts these live sessions.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves active WebSocket sessions remaining connected after device removal or token revocation, allowing unauthorized access through live sessions.
To detect this issue on your network or system, you should monitor active WebSocket connections associated with devices or tokens that have been revoked or removed.
Suggested commands or approaches include:
- Check the list of active WebSocket sessions on the OpenClaw gateway server and correlate them with the current list of valid devices and tokens.
- Use network monitoring tools (e.g., tcpdump, Wireshark) to identify persistent WebSocket connections from devices or clients that should no longer have access.
- If you have access to the OpenClaw server logs or API, query for active sessions and verify if any belong to revoked or removed devices.
- No specific commands are provided in the available resources, but focusing on WebSocket session management and correlating session data with device/token status is key.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to upgrade OpenClaw to version 2026.3.28 or later, where the vulnerability has been fixed.
The fix ensures that when a device is removed or a token is revoked, all active WebSocket sessions associated with that device or token are disconnected promptly.
If immediate upgrade is not possible, consider manually forcing reconnection of WebSocket sessions or restarting the OpenClaw gateway service to terminate existing sessions.
Additionally, review and monitor active sessions regularly to detect and terminate any unauthorized persistent connections.