AI agent vulnerability · OpenClaw

CVE-2026-34503: OpenClaw's device removal and token revocation do not terminate active WebSocket sessions

highCVSS 4.0 8.6 · 3.1 7.5GHSA-2pr2-hcv6-7gwv

Summary Removing a device or revoking its token updated stored credentials but did not disconnect already-authenticated WebSocket sessions. Impact A revoked device could continue using its existing live session until reconnect, extending access beyond credential removal.

Published Mar 31, 2026 · Updated Apr 6, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: <= 2026.3.24
Fixed in: 2026.3.28
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

Removing a device or revoking its token updated stored credentials but did not disconnect already-authenticated WebSocket sessions.

Impact

A revoked device could continue using its existing live session until reconnect, extending access beyond credential removal.

Affected Component

src/gateway/server-methods/devices.ts, src/gateway/server.impl.ts

Fixed Versions

Affected: <= 2026.3.24
Patched: >= 2026.3.28
Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit 7a801cc451 (Gateway: disconnect revoked device sessions).

OpenClaw thanks @AntAISecurityLab for reporting.

Credited to AntAISecurityLab.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries