{"id":"EUVD-2026-17469","enisaUuid":"990f3ba9-741d-3f12-8a79-a285fe1ba901","description":"OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.","datePublished":"Mar 31, 2026, 2:10:34 PM","dateUpdated":"Sep 24, 2026, 2:17:27 PM","baseScore":8.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2pr2-hcv6-7gwv\nhttps://github.com/openclaw/openclaw/commit/7a801cc451e9e667b705eeccff651923a1b8c863\nhttps://www.vulncheck.com/advisories/openclaw-incomplete-websocket-session-termination-on-device-removal-and-token-revocation\n","aliases":"CVE-2026-34503\n","assigner":"VulnCheck","epss":0.34,"enisaIdProduct":[{"id":"5ebd5b77-8903-3556-be48-93b53a21b16a","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.3.28"}],"enisaIdVendor":[{"id":"d35504a2-f96f-355f-b6c9-dc41d0a7fc12","vendor":{"name":"OpenClaw"}}],"enisaIdVulnerability":[{"id":"930bb39f-8800-3499-ae9f-99b77ef9c6b5","vulnerability":{"id":"GHSA-2pr2-hcv6-7gwv","description":"OpenClaw\u0027s device removal and token revocation do not terminate active WebSocket sessions","datePublished":"Mar 31, 2026, 11:52:03 PM","dateUpdated":"Apr 6, 2026, 5:33:55 PM","baseScore":0.0,"references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2pr2-hcv6-7gwv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34503\nhttps://github.com/openclaw/openclaw/commit/7a801cc451e9e667b705eeccff651923a1b8c863\nhttps://github.com/openclaw/openclaw\nhttps://www.vulncheck.com/advisories/openclaw-incomplete-websocket-session-termination-on-device-removal-and-token-revocation\n","enisa_id":"EUVD-2026-17469\n","aliases":"GHSA-2pr2-hcv6-7gwv\nCVE-2026-34503\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:54:31 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c6c5e97e-21a5-322e-8ab8-79b092abff54","vulnerability":{"id":"CVE-2026-34503","description":"OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.","datePublished":"Mar 31, 2026, 2:10:34 PM","dateUpdated":"Sep 24, 2026, 2:17:27 PM","status":"PUBLISHED","baseScore":8.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2pr2-hcv6-7gwv\nhttps://github.com/openclaw/openclaw/commit/7a801cc451e9e667b705eeccff651923a1b8c863\nhttps://www.vulncheck.com/advisories/openclaw-incomplete-websocket-session-termination-on-device-removal-and-token-revocation\n","enisa_id":"EUVD-2026-17469\n","assigner":"VulnCheck","epss":0.34,"dataProcessed":"Oct 30, 2026, 7:18:58 AM","vulnerabilityProduct":[{"id":"4b9621ec-c4c4-3e92-8b43-8cd992bd1414","product":{"name":"OpenClaw","vendor":{"name":"n/a"}},"product_version":"0 \u003c2026.3.28"}],"vulnerabilityVendor":[{"id":"77b5575e-a620-3a24-9250-4dae88a0dea0","vendor":{"name":"OpenClaw"}}]}}],"enisaIdAdvisory":[{"id":"0193fcb2-b23e-3ef5-9902-0907aef2dcaa","advisory":{"id":"WID-SEC-W-2026-0930","description":"OpenClaw: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen oder andere, nicht näher spezifizierte Angriffe durchzuführen.","datePublished":"Mar 30, 2026, 10:00:00 PM","dateUpdated":"Apr 28, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0930.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-0930\n","aliases":"CVE-2026-33576\nCVE-2026-33577\nCVE-2026-33578\nCVE-2026-33579\nCVE-2026-33580\nCVE-2026-33581\nCVE-2026-34503\nCVE-2026-34504\nCVE-2026-41303\nCVE-2026-41332\nCVE-2026-41342\nCVE-2026-41344\nCVE-2026-41361\nCVE-2026-41367\nCVE-2026-41368\nCVE-2026-41371\nCVE-2026-41380\nCVE-2026-41395\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"916871f7-7abb-33b2-a5b7-8fab819bbc05","product":{"name":"2026.3.28","vendor":{"name":"open source"}}},{"id":"dd101b2f-0984-30e9-8e6c-624c033416de","product":{"name":"OpenClaw","vendor":{"name":"n/a"}}}]}}]}