What’s Vulnerable › Vulnerabilities

CVE-2026-28485: OpenClaw 2026.1.5 < 2026.2.12 - Missing Authentication in Browser Control HTTP Endpoints

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-05 · updated 2026-06-17
• Weakness: CWE-306

Description

OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized local callers to invoke privileged operations. Remote attackers on the local network or local processes can execute arbitrary browser-context actions and access sensitive in-session data by sending requests to unauthenticated endpoints.

Affected products

• OpenClaw: through 2026.1.5; from 2026.2.9 before 2026.2.12 — fixed in 2026.2.12

How to fix

Upgrade to a fixed version: OpenClaw 2026.2.12. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/commit/9230a2ae14307740a13ada7afd6dcfab34e0287f
• https://github.com/openclaw/openclaw/security/advisories/GHSA-qpjj-47vm-64pj
• https://www.vulncheck.com/advisories/openclaw-missing-authentication-in-browser-control-http-endpoints

Get alerted when CVE-2026-28485 or the next vulnerability affects your stack