CVE-2026-34503
Openclaw ≤ 2026.3.28
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-34503 is a high-severity Insufficient Session Expiration (CWE-613) vulnerability in Openclaw Openclaw. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 26th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-12 (Session Termination) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-34503 is a vulnerability in OpenClaw versions prior to 2026.3.28, where the software fails to disconnect active WebSocket sessions when associated devices are removed or authentication tokens are revoked. This issue, tied to CWE-613 (Insufficient Session Expiration), allows persistent connections despite credential invalidation. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting high severity due to its network accessibility, low complexity, and potential for significant confidentiality and integrity impacts.
Attackers require low privileges (PR:L) to initially establish a session but can exploit the flaw remotely over the network with no user interaction. Once credentials are revoked or devices removed, the attacker maintains unauthorized access through existing live WebSocket sessions until a forced reconnection disrupts them, enabling prolonged unauthorized actions with high confidentiality and integrity consequences.
Advisories recommend upgrading to OpenClaw 2026.3.28 or later, which includes the fixing commit 7a801cc451e9e667b705eeccff651923a1b8c863. Additional guidance appears in the GitHub security advisory at GHSA-2pr2-hcv6-7gwv and the VulnCheck advisory on incomplete WebSocket session termination.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17469
Vulnerability Data
OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-12 directly requires automatic session termination after a defined period, structurally preventing reuse of expired session identifiers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Credential lifecycle management directly includes enforcing session expiration to prevent reuse.
Authentication mechanisms can incorporate session timeout checks but do not inherently address expiration policy.
Authorization policy enforcement and review covers terminating stale sessions to limit access scope.