Executive brief
OpenClaw is an open-source access control and device management platform. When an administrator removes a device or revokes its authentication token, the system fails to disconnect existing WebSocket sessions, allowing attackers with revoked credentials to maintain unauthorized access until they are forced to reconnect. This creates a window during which previously-authorized but now-revoked devices can continue operating undetected.
Technical details
The vulnerability is an incomplete session termination flaw affecting OpenClaw's WebSocket gateway implementation (components: src/gateway/server-methods/devices.ts, src/gateway/server.impl.ts). When device removal or token revocation occurs, stored credentials are updated but active WebSocket sessions remain authenticated and functional. An attacker with a revoked credential can exploit this by maintaining an existing live session to perform operations until a forced reconnection occurs. The vulnerability requires an attacker to have previously obtained valid credentials and established an active WebSocket connection before revocation. The issue has been patched in version 2026.3.28 (commit 7a801cc451) which implements proper session disconnection upon credential revocation.
Affected products
- OpenClaw OpenClaw before 2026.3.28
Timeline
- 2026-03-29: disclosed
- 2026-03-28: patched: Fix released in version 2026.3.28 via commit 7a801cc451
- 2026-03-31: advisory: GHSA-89hr-6x2p-8xjv published (later withdrawn as duplicate of GHSA-2pr2-hcv6-7gwv)