OpenClaw < 2026.3.28 - Incomplete WebSocket Session Termination on Device Removal and Token Revocation
cve-program · CVE-2026-34503
PublishedOpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.
Read the publisher's advisoryeuvd · EUVD-2026-17469
PublishedOpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.
Read the publisher's advisorynvd · CVE-2026-34503
PublishedOpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.
Read the publisher's advisoryosv · GHSA-2pr2-hcv6-7gwv
Published## Summary Removing a device or revoking its token updated stored credentials but did not disconnect already-authenticated WebSocket sessions. ## Impact A revoked device could continue using its existing live session until reconnect, extending access beyond credential removal. ## Affected Component `src/gateway/server-methods/devices.ts, src/gateway/server.impl.ts` ## Fixed Versions - Affected: `<= 2026.3.24` - Patched: `>= 2026.3.28` - Latest stable `2026.3.28` contains the fix. ## Fix Fixed by commit `7a801cc451` (`Gateway: disconnect revoked device sessions`). OpenClaw thanks @AntAISecurityLab for reporting.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-34503 · CVE overview and exploitation status
cve-program · CVE-2026-34503
- https://github.com/openclaw/openclaw/security/advisories/GHSA-2pr2-hcv6-7gwv
- https://github.com/openclaw/openclaw/commit/7a801cc451e9e667b705eeccff651923a1b8c863
- https://www.vulncheck.com/advisories/openclaw-incomplete-websocket-session-termination-on-device-removal-and-token-revocation
euvd · EUVD-2026-17469
- https://github.com/openclaw/openclaw/security/advisories/GHSA-2pr2-hcv6-7gwv
- https://github.com/openclaw/openclaw/commit/7a801cc451e9e667b705eeccff651923a1b8c863
- https://www.vulncheck.com/advisories/openclaw-incomplete-websocket-session-termination-on-device-removal-and-token-revocation
nvd · CVE-2026-34503
- https://github.com/openclaw/openclaw/commit/7a801cc451e9e667b705eeccff651923a1b8c863
- https://github.com/openclaw/openclaw/security/advisories/GHSA-2pr2-hcv6-7gwv
- https://www.vulncheck.com/advisories/openclaw-incomplete-websocket-session-termination-on-device-removal-and-token-revocation
osv · GHSA-2pr2-hcv6-7gwv
- https://github.com/openclaw/openclaw/security/advisories/GHSA-2pr2-hcv6-7gwv
- https://nvd.nist.gov/vuln/detail/CVE-2026-34503
- https://github.com/openclaw/openclaw/commit/7a801cc451e9e667b705eeccff651923a1b8c863
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-incomplete-websocket-session-termination-on-device-removal-and-token-revocation
Related changes
Linked by CVE identifierNo related changes are available here.