CVE-2026-34503: OpenClaw < 2026.3.28 - Incomplete WebSocket Session Termination on Device Removal and Token Revocation
Summary
Removing a device or revoking its token updated stored credentials but did not disconnect already-authenticated WebSocket sessions.
Impact
A revoked device could continue using its existing live session until reconnect, extending access beyond credential removal.
Affected Component
src/gateway/server-methods/devices.ts, src/gateway/server.impl.ts
Fixed Versions
- Affected: <= 2026.3.24 - Patched: >= 2026.3.28 - Latest stable 2026.3.28 contains the fix.
Fix
Fixed by commit 7a801cc451 (Gateway: disconnect revoked device sessions).
Other sources
OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.3.28 - Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.3.28Patch 7a801cc451 - Compensating control
If upgrading is not immediately possible, revoke/terminate existing WebSocket sessions for removed devices/revoked tokens by forcing client reconnection (the issue allows continued access until reconnect).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34503?
CVE-2026-34503 is categorized as a high severity vulnerability due to the risk of unauthorized access through active WebSocket sessions.
How do I fix CVE-2026-34503?
To fix CVE-2026-34503, upgrade OpenClaw to version 2026.3.28 or later, which addresses the incomplete WebSocket session termination.
What vulnerabilities are associated with CVE-2026-34503?
CVE-2026-34503 specifically relates to the failure of OpenClaw to disconnect WebSocket sessions upon device removal or token revocation.
Who is affected by CVE-2026-34503?
Users of OpenClaw versions prior to 2026.3.28 are at risk due to the incomplete session termination vulnerability.
What type of attack can exploit CVE-2026-34503?
CVE-2026-34503 can be exploited by attackers who have revoked credentials but can still maintain access via active WebSocket sessions.