CVE-2026-28472 CRITICAL

CVE-2026-28472: OpenClaw < 2026.2.2 - Device Identity Check Bypass in Gateway WebSocket Connect Handshake

Vendor Openclaw

Product OpenClaw

Weakness CWE-306 · Missing auth

Published March 5, 2026

Last update March 9, 2026

View on NVD All CVEs

CVSS base score

9.2/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw versions prior to 2026.2.2 contain a vulnerability in the gateway WebSocket connect handshake in which it allows skipping device identity checks when auth.token is present but not validated. Attackers can connect to the gateway without providing device identity or pairing by exploiting the presence check instead of validation, potentially gaining operator access in vulnerable deployments.

Key dates

02Disclosure timeline

March 5, 2026 CVE published

March 9, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-28472 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/306.html

Related vulnerabilities

04Related CVE

CVE-2026-27772 EV Energy ev.energy Missing Authentication for Critical Function CVE-2023-27377 Missing Authentication In IDAttend’s IDWeb Application CVE-2026-56782 Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints CVE-2025-14567 haxxorsid Stock-Management-System employees missing authentication CVE-2024-30391 Junos OS: MX Series with SPC3, and SRX Series: When IPsec authentication is configured with "hmac-sha-384" and "hmac-sha-512" no authentication of traffic is performed