CVE-2026-34503 — HIGH (8.1)

Q: How severe is CVE-2026-34503?

CVE-2026-34503 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-34503?

Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.

Vulnerability Description

OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.

CVSS Score

8.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Openclaw	Openclaw	< 2026.3.28

Related Weaknesses (CWE)

CWE-613

References

https://github.com/openclaw/openclaw/commit/7a801cc451e9e667b705eeccff651923a1b8Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-2pr2-hcv6-7gwvVendor Advisory
https://www.vulncheck.com/advisories/openclaw-incomplete-websocket-session-termiThird Party Advisory

FAQ

What is CVE-2026-34503?

CVE-2026-34503 is a vulnerability with a CVSS score of 8.1 (HIGH). OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through exis...

How severe is CVE-2026-34503?

CVE-2026-34503 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-34503?

Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.