VYPR
← All advisories
High severity8.4NVD Advisory· Published Mar 5, 2026· Updated Jun 17, 2026

CVE-2026-28485

CVE-2026-28485

Description

OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized local callers to invoke privileged operations. Remote attackers on the local network or local processes can execute arbitrary browser-context actions and access sensitive in-session data by sending requests to unauthenticated endpoints.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • OpenClaw/Openclaw3 versions
    cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*+ 2 more
    • cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <=2026.1.5
    • (no CPE)range: <2026.2.12
    • (no CPE)range: 2026.1.5

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.