CVE-2026-28472: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-28472 is an authentication bypass vulnerability in OpenClaw's gateway WebSocket connect handshake that allows attackers to skip device identity checks when auth.token is present but not validated. It affects all OpenClaw (npm) versions up to and including 2026.2.1, with the fix introduced in version 2026.2.2. The vulnerability was published on March 5, 2026, and assigned by VulnCheck. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.2 (Critical) (GitHub Advisory, Feedly).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function). In src/gateway/server/ws-connection/message-handler.ts, the device-identity bypass logic evaluated the mere presence of a non-empty connectParams.auth.token rather than the result of a validated shared-secret authentication check — effectively a presence check instead of a validation check. This allowed a client to connect to the gateway WebSocket without providing valid device identity or completing the pairing process. The fix (commit fe81b1d) refactors the logic so that skipping device identity now requires a confirmed sharedAuthOk result, meaning the token must pass actual shared-secret validation before the bypass is permitted (GitHub Advisory, Fix Commit).

Successful exploitation allows an unauthenticated network attacker to connect to the OpenClaw gateway WebSocket without valid device identity or pairing, potentially gaining operator-level access to the deployment. This could result in unauthorized access to sensitive data managed by OpenClaw, manipulation of connected infrastructure, and full system compromise depending on the deployment's configuration and the capabilities exposed through the gateway. The impact is most severe in deployments where the gateway WebSocket is reachable from untrusted networks (GitHub Advisory, Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.039%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no privileges, no user interaction, and is remotely exploitable over the network, making it straightforward to exploit if the gateway WebSocket is exposed to untrusted parties.

1. Reconnaissance: Identify OpenClaw deployments with an exposed gateway WebSocket endpoint (e.g., via Shodan, Censys, or network scanning for WebSocket services). Confirm the version is 2026.2.1 or earlier.
2. Craft a WebSocket connection request: Initiate a WebSocket upgrade request to the gateway endpoint (e.g., ws://<target>:<port>) without providing valid device identity or pairing credentials.
3. Supply a non-empty auth.token: In the WebSocket connect handshake message, include a connectParams.auth.token field with any non-empty string value. The vulnerable code checks only for the presence of this field, not its validity.
4. Bypass device identity check: Because the pre-fix logic uses hasTokenAuth (presence check) rather than a validated auth result to set canSkipDevice, the device identity requirement is bypassed and the connection proceeds.
5. Achieve operator access: Once connected without device identity or pairing, the attacker may gain operator-level access to the gateway, enabling unauthorized control of connected infrastructure, data access, or further lateral movement within the deployment (GitHub Advisory, Fix Commit).

• Network: Unexpected WebSocket upgrade requests to the OpenClaw gateway port from untrusted or external IP addresses; connections that complete the handshake without a valid device identity or pairing sequence.
• Logs: Gateway access logs showing successful WebSocket connections (handshake state: connected) from clients with no associated device identity (device: null) and no prior pairing record; log entries with conn= identifiers lacking a device ID.
• Process/Application: Operator-level actions (configuration changes, data access, command execution) in gateway audit logs attributed to sessions with no recognized device identity or pairing token.
• Authentication: WebSocket connect frames containing a non-empty auth.token field but no valid shared-secret match, particularly from previously unseen client IDs or IP addresses (GitHub Advisory).

Upgrade all OpenClaw deployments to version 2026.2.2 or later, which enforces validated shared-secret authentication before permitting device identity bypass (GitHub Advisory, Fix Commit). For environments where immediate patching is not possible, restrict gateway WebSocket access to trusted networks only — for example, by enforcing Tailscale ACLs or firewall rules so that only trusted users can reach the gateway endpoint. Review access logs for unauthorized connection attempts and ensure no untrusted parties have network-level access to the gateway WebSocket port.

The vulnerability received coverage from security news outlets including The Hacker Wire and was discussed on Mastodon and Twitter/X (Feedly). Belgium's Centre for Cybersecurity (CCB) issued an advisory warning about multiple critical vulnerabilities in OpenClaw's Nextcloud Talk plugin, including this issue. Community discussion appeared on Hacker News. The original reporter (simecek) and analyst (stanislavfortaisle) were credited in the GitHub security advisory (GitHub Advisory).