OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through exi…
高危 CVSS 8.1
摘要
OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.
中文摘要建设中，暂以英文摘要呈现（DR-003 v2）。
深度研判 · 自动通道
该漏洞尚未生成深度研判报告（DR-003 v2 AI pipeline 建设中）。
受影响产品
- :
数据来源
- NVD DATABASE
原始链接
- https://github.com/openclaw/openclaw/commit/7a801cc451e9e667b705eeccff651923a1b8c863 Patch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-2pr2-hcv6-7gwv Vendor Advisory
- https://www.vulncheck.com/advisories/openclaw-incomplete-websocket-session-termination-on-device-removal-and-token-revocation Third Party Advisory
时间线
- nvd_ingest NVD