CVE-2026-28472 - Vulnerability Analysis

Overview

OpenClaw < 2026.2.2 contains an authentication bypass caused by skipping device identity checks when auth.token is present but not validated in the gateway WebSocket connect handshake, letting attackers gain operator access without device identity or pairing.

Severity & Score

Impact

Attackers can gain operator access without device identity or pairing, potentially controlling the gateway.

Mitigation

Update to version 2026.2.2 or later.

References

• https://github.com/openclaw/openclaw/security/advisories/GHSA-rv39-79c4-7459
• https://www.vulncheck.com/advisories/openclaw-device-identity-check-bypass-in-gateway-websocket-connect-handshake
• https://github.com/openclaw/openclaw/commit/fe81b1d7125a014b8280da461f34efbf5f761575

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 6, 2026

🔴 CVE-2026-28472 - Critical (9.8) OpenClaw versions prior to 2026.2.2 contain a vulnerability in the gateway WebSocket connect handshake in which it allows skipping device identity checks when auth.token is present but not validated. Attackers can connect to the gateway without pr... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28472/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner