CVE-2026-28485: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-28485 is a missing authentication vulnerability in OpenClaw's local browser-control HTTP interface, specifically affecting the /agent/act route. It affects OpenClaw versions up to and including 2026.1.5, and versions 2026.2.9 through 2026.2.11 (i.e., all versions prior to 2026.2.12). The vulnerability was published on March 5, 2026, with a patch released on March 10, 2026. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is CWE-306 (Missing Authentication for Critical Function): the browser-control HTTP route /agent/act in OpenClaw did not consistently enforce authentication when gateway auth was not explicitly configured, allowing any local caller to invoke privileged browser-context operations without credentials. The vulnerability exists in src/browser/routes/agent.act.ts and src/browser/pw-tools-core.interactions.ts. Because the route is loopback-bound, exploitation is primarily limited to local processes or local-network attackers who can reach the loopback interface (e.g., via a local proxy or SSRF). The fix enforces mandatory authentication on all browser-control HTTP routes and auto-generates a strong gateway.auth.token when browser control is enabled without existing auth configured (GitHub Advisory, Fix Commit).

Successful exploitation allows unauthorized local processes or local-network attackers to execute arbitrary browser-context actions against managed OpenClaw sessions without any credentials. This includes access to sensitive in-session data (e.g., session tokens, page content, credentials visible in the browser) and the ability to perform privileged browser operations such as navigation and interaction with managed pages. The impact spans high confidentiality loss, high integrity loss, and low-to-high availability impact depending on the scoring version used (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.063%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation requires the ability to send HTTP requests to the loopback interface of a host running a vulnerable OpenClaw instance, which limits the attack surface to local processes or local-network scenarios (GitHub Advisory).

1. Reconnaissance: Identify hosts running OpenClaw versions ≤ 2026.1.5 or 2026.2.9–2026.2.11 with browser control enabled. This can be done via local process enumeration or network scanning for the OpenClaw gateway port on the local network.
2. Locate the browser-control endpoint: Determine the loopback address and port used by OpenClaw's browser-control HTTP service (default loopback-bound, e.g., http://127.0.0.1:<port>/agent/act).
3. Send unauthenticated request: Craft an HTTP request to the /agent/act endpoint without any Authorization header or password, targeting a desired browser-context action (e.g., navigate, interact, snapshot).
4. Execute privileged browser action: The server processes the request without authentication checks, executing the requested browser-context operation against the managed session.
5. Access sensitive data: Extract in-session data such as page content, cookies, or credentials exposed within the managed browser session via subsequent unauthenticated requests to the same endpoint (GitHub Advisory, Fix Commit).

• Network: Unexpected HTTP requests to the OpenClaw browser-control loopback endpoint (/agent/act) originating from processes or hosts other than the legitimate OpenClaw agent; requests lacking Authorization: Bearer or x-openclaw-password headers on the browser-control port.
• Logs: OpenClaw access logs showing requests to /agent/act without authentication headers, especially from unexpected source processes or IPs; repeated or automated request patterns to browser-control routes.
• Process: Unusual child processes or browser actions (navigation, form submission, screenshot capture) initiated without corresponding user activity in the OpenClaw session logs.
• File System: Unexpected changes to gateway.auth.token in the OpenClaw configuration file, or absence of a configured auth token on systems where browser control is enabled (indicating the vulnerable configuration was present).

Upgrade OpenClaw to version 2026.2.12 or later, which enforces mandatory authentication on all browser-control HTTP routes and auto-generates a strong gateway.auth.token when browser control is enabled without existing auth (Fix Commit, GitHub Advisory). As a temporary workaround prior to patching, manually configure a strong gateway.auth.token or password in the OpenClaw configuration, and apply network segmentation or host-based firewall rules to restrict access to the browser-control loopback port to trusted processes only. Avoid exposing the OpenClaw gateway to untrusted local networks.

The vulnerability was responsibly disclosed by researcher @tcusolle and credited in the official GitHub Security Advisory and the fix commit changelog (GitHub Advisory, Fix Commit). Community aggregators including RedPacket Security, Vulners, and CVEFeed.io picked up the disclosure shortly after publication. A blog post on flyingpenguin.com referenced OpenClaw in the context of a broader discussion of CVEs patched by AI agents, noting the irony of AI-assisted tools introducing security gaps (Feedly).