CVE-2026-34503
Summary
Removing a device or revoking its token updated stored credentials but did not disconnect already-authenticated WebSocket sessions.
Impact
A revoked device could continue using its existing live session until reconnect, extending access beyond credential removal.
Affected Component
src/gateway/server-methods/devices.ts, src/gateway/server.impl.ts
Fixed Versions
- Affected:
<= 2026.3.24 - Patched:
>= 2026.3.28 - Latest stable
2026.3.28contains the fix.
Fix
Fixed by commit 7a801cc451 (Gateway: disconnect revoked device sessions).
OpenClaw thanks @AntAISecurityLab for reporting.
Package Versions Affected
Automatically patch vulnerabilities without upgrading
CVSS Version



Related Resources
References
https://github.com/openclaw/openclaw/security/advisories/GHSA-2pr2-hcv6-7gwv, https://nvd.nist.gov/vuln/detail/CVE-2026-34503, https://github.com/openclaw/openclaw/commit/7a801cc451e9e667b705eeccff651923a1b8c863, https://github.com/openclaw/openclaw, https://www.vulncheck.com/advisories/openclaw-incomplete-websocket-session-termination-on-device-removal-and-token-revocation
