CVE-2026-34503: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-34503 is an Insufficient Session Expiration vulnerability (CWE-613) in OpenClaw, a Node.js npm package, where device removal and token revocation operations fail to terminate active WebSocket sessions. Affected versions are all releases up to and including 2026.3.24; the patched version is 2026.3.28. The vulnerability was reported by @AntAISecurityLab, published to the GitHub Advisory Database on March 31, 2026, and assigned CVE-2026-34503. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory GHSA-2pr2-hcv6-7gwv).

The root cause is CWE-613 (Insufficient Session Expiration): when an administrator removes a paired device or revokes a device token via the gateway API, the server updated stored credentials in src/gateway/server-methods/devices.ts but did not call any session-termination logic against already-connected WebSocket clients in src/gateway/server.impl.ts. As a result, authenticated WebSocket sessions established before the revocation event remained open and fully functional. The fix introduced a disconnectClientsForDevice() function that iterates active gateway clients and closes matching sockets with code 4001 ("device removed"), invoked asynchronously via queueMicrotask() after the revocation response is sent (GitHub Commit 7a801cc, GitHub Advisory GHSA-2pr2-hcv6-7gwv).

An attacker whose device credentials have been revoked or whose device has been removed can continue to use the existing live WebSocket session indefinitely — until the connection is naturally dropped or the server restarts — without needing to re-authenticate. This enables continued unauthorized data exfiltration and system manipulation through a persistent authenticated session, with high confidentiality and integrity impact on the vulnerable system. Availability is not directly impacted by this vulnerability (GitHub Advisory GHSA-2pr2-hcv6-7gwv, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). No threat actor attribution has been reported. The EPSS score is approximately 0.027% (very low probability of exploitation within 30 days), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires that an attacker already possess valid credentials and an established WebSocket session prior to revocation — a relatively constrained precondition.

1. Obtain credentials and establish a session: The attacker authenticates to the OpenClaw gateway using valid device credentials, establishing an active WebSocket connection.
2. Trigger credential revocation: An administrator (or the attacker, if they have sufficient access) revokes the device token or removes the device via the device.token.revoke or device.pair.remove gateway methods on a vulnerable OpenClaw instance (≤ 2026.3.24).
3. Maintain the existing session: Because the vulnerable server does not call disconnectClientsForDevice(), the attacker's WebSocket connection remains open and authenticated despite the revocation.
4. Continue unauthorized access: The attacker continues to send and receive messages over the persistent WebSocket session, exfiltrating data or manipulating system state, until the connection is naturally interrupted or the server is restarted (GitHub Advisory GHSA-2pr2-hcv6-7gwv, GitHub Commit 7a801cc).

• Network: Active WebSocket connections (upgrade requests or persistent TCP sessions to the OpenClaw gateway port) originating from devices or IPs whose credentials have been revoked; WebSocket sessions that remain open for an unusually long duration after a device removal or token revocation event.
• Logs: Gateway logs showing device token revoked or device pairing removed entries for a device, followed by continued gateway activity (requests, responses) from the same device ID or connection without a subsequent reconnection handshake; absence of WebSocket close code 4001 ("device removed") in server logs for a revoked device on vulnerable versions.
• Application State: Device IDs present in the active client list (clients set in server.impl.ts) that are also present in the revoked/removed device records in the credential store.

Upgrade OpenClaw (npm package) to version 2026.3.28 or later, which contains the fix introduced in commit 7a801cc that actively disconnects WebSocket sessions for revoked devices (GitHub Advisory GHSA-2pr2-hcv6-7gwv, GitHub Commit 7a801cc). As an interim workaround on unpatched instances, administrators should restart the OpenClaw gateway server immediately after revoking credentials or removing devices to force all active WebSocket sessions to terminate. Additionally, implement periodic session re-authentication requirements and monitor gateway logs for continued activity from recently revoked device IDs.

The vulnerability was reported by security researcher @AntAISecurityLab and acknowledged by the OpenClaw maintainers in the official GitHub Security Advisory (GitHub Advisory GHSA-2pr2-hcv6-7gwv). A duplicate advisory (GHSA-89hr-6x2p-8xjv) was published and subsequently withdrawn on March 31, 2026. No significant broader media coverage or notable community commentary beyond standard vulnerability aggregator coverage has been identified.