CVE-2026-28472 | THREATINT

Description

OpenClaw versions prior to 2026.2.2 contain a vulnerability in the gateway WebSocket connect handshake in which it allows skipping device identity checks when auth.token is present but not validated. Attackers can connect to the gateway without providing device identity or pairing by exploiting the presence check instead of validation, potentially gaining operator access in vulnerable deployments.

PUBLISHED Reserved 2026-02-27 | Published 2026-03-05 | Updated 2026-03-06 | Assigner VulnCheck

CRITICAL: 9.2CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

HIGH: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

Missing Authentication for Critical Function

Product status

Default status

unaffected

Any version before 2026.2.2

affected

Credits

Petr Simecek (@simecek) reporter

Stanislav Fort, Aisle Research, www.aisle.com analyst

References

github.com/...enclaw/security/advisories/GHSA-rv39-79c4-7459 (GitHub Security Advisory (GHSA-rv39-79c4-7459)) vendor-advisory

github.com/...ommit/fe81b1d7125a014b8280da461f34efbf5f761575 (Patch Commit) patch

www.vulncheck.com/...-in-gateway-websocket-connect-handshake (VulnCheck Advisory: OpenClaw < 2026.2.2 - Device Identity Check Bypass in Gateway WebSocket Connect Handshake) third-party-advisory

cve.org (CVE-2026-28472)

nvd.nist.gov (CVE-2026-28472)

Download JSON