CVE-2026-34503 in OpenClaw
摘要 (英语)
OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
负责
VulnCheck
预定
2026-03-30
披露
2026-03-31
状态
已确认
条目
VulDB provides additional information and datapoints for this CVE:
| 标识符 | 漏洞 | CWE | 可利用 | 对策 | CVE |
|---|---|---|---|---|---|
| 354415 | OpenClaw WebSocket 弱身份验证 | 613 | 未定义 | 官方修复 | CVE-2026-34503 |