CVE-2026-28485

HIGH EPSS 9.6%
Published Mar 5, 20263mo ago · Modified Jun 17, 20261w ago
7.5 CVSS 4.0
High
Find Similar
Published Mar 5, 2026 3mo ago
Last Modified Jun 17, 2026 1w ago

Description

OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized local callers to invoke privileged operations. Remote attackers on the local network or local processes can execute arbitrary browser-context actions and access sensitive in-session data by sending requests to unauthenticated endpoints.

CVSS Details

Base Score
7.5
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
9.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-306 Missing Authentication for Critical Function Authentication

Affected Products 2

VendorProductVersionRange
openclawopenclaw* ≤2026.1.5
openclawopenclaw*≥2026.2.9  –  <2026.2.12

References 3

  • github.com https://github.com/openclaw/openclaw/commit/9230a2ae14307740a13ada7afd6dcfab34e0287f
    Patch
  • github.com https://github.com/openclaw/openclaw/security/advisories/GHSA-qpjj-47vm-64pj
    Vendor Advisory
  • vulncheck.com https://www.vulncheck.com/advisories/openclaw-missing-authentication-in-browser-control-http-endpoints
    Third Party Advisory

Remediation

  • github.com https://github.com/openclaw/openclaw/commit/9230a2ae14307740a13ada7afd6dcfab34e0287f
    Patch