CVE-2026-34503: OpenClaw WebSocket session persists

CISO Take

OpenClaw, an AI agent framework, fails to invalidate active WebSocket sessions when a device is removed or a user's access token is revoked — meaning an attacker retains live system access even after administrators believe the threat has been neutralized. With EPSS placing this in the top 75th percentile for exploitation likelihood and a CVSS of 8.1 (Confidentiality: High, Integrity: High), the gap between administrative revocation and actual session termination directly undermines incident response playbooks that treat token revocation as equivalent to access termination. While there are only 4 known downstream dependents and no public exploit or CISA KEV listing, the low attack complexity and zero user interaction requirement make this trivially abusable by any attacker who establishes a WebSocket connection before their credentials are revoked. Upgrade immediately to OpenClaw 2026.3.28 or later and audit all active WebSocket sessions for connections originating from revoked or deprovisioned credentials.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

High risk for organizations using OpenClaw in agentic AI workflows. CWE-613 (Insufficient Session Expiration) combined with a network-accessible attack vector and low privilege requirement creates a scenario where administrative token revocation — a core incident containment action — provides false assurance of access termination. An EPSS of 0.00332 placing this in the top 75th percentile, alongside a CVSS 8.1 reflecting real confidentiality and integrity impact with no availability degradation, indicates attackers preserve covert access rather than disrupting service. The risk is concentrated in insider threat and post-compromise containment scenarios where administrators revoke credentials expecting immediate session termination but the session persists silently.

How does the attack unfold?

Initial Access

Attacker obtains low-privilege credentials and establishes a WebSocket session with the OpenClaw AI agent platform over the network.

AML.T0012

Revocation Evasion

Victim organization revokes the attacker's tokens and removes the compromised device during incident response, but OpenClaw does not terminate the existing WebSocket session, leaving the connection live.

AML.T0091.000

Persistent Unauthorized Access

Attacker maintains the live WebSocket session to continue querying the AI agent and invoking its tools while incident responders believe access has been fully contained.

AML.T0053

Data Exfiltration and Lateral Movement

Leveraging the agent's persistent tool permissions, the attacker exfiltrates sensitive data, issues commands, or moves laterally through resources accessible within the AI agent's authorization scope.

AML.T0086

Initial Access

Attacker obtains low-privilege credentials and establishes a WebSocket session with the OpenClaw AI agent platform over the network.

AML.T0012

Revocation Evasion

Victim organization revokes the attacker's tokens and removes the compromised device during incident response, but OpenClaw does not terminate the existing WebSocket session, leaving the connection live.

AML.T0091.000

Persistent Unauthorized Access

Attacker maintains the live WebSocket session to continue querying the AI agent and invoking its tools while incident responders believe access has been fully contained.

AML.T0053

Data Exfiltration and Lateral Movement

Leveraging the agent's persistent tool permissions, the attacker exfiltrates sensitive data, issues commands, or moves laterally through resources accessible within the AI agent's authorization scope.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A None

What should I do?

5 steps

Upgrade OpenClaw to version 2026.3.28 or later (patch commit 7a801cc451e9e667b705eeccff651923a1b8c863).
As an immediate workaround on unpatched systems, restart the OpenClaw service to force session renegotiation and terminate all active WebSocket connections.
Implement network-layer WebSocket session monitoring to detect long-lived connections (greater than 24 hours) and correlate against the current valid token list.
Review audit logs for WebSocket sessions that were active after corresponding device removal or token revocation events to identify potential exploitation windows.
In high-risk environments, place OpenClaw behind an API gateway or reverse proxy that enforces session termination at the network layer independent of application-level revocation logic.

How is it classified?

Auth Bypass Data Extraction Agent AML.T0012 - Valid Accounts AML.T0053 - AI Agent Tool Invocation AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

8.4 - AI system lifecycle

NIST AI RMF

GOVERN 1.1 - Organizational risk management policies

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-34503?

OpenClaw, an AI agent framework, fails to invalidate active WebSocket sessions when a device is removed or a user's access token is revoked — meaning an attacker retains live system access even after administrators believe the threat has been neutralized. With EPSS placing this in the top 75th percentile for exploitation likelihood and a CVSS of 8.1 (Confidentiality: High, Integrity: High), the gap between administrative revocation and actual session termination directly undermines incident response playbooks that treat token revocation as equivalent to access termination. While there are only 4 known downstream dependents and no public exploit or CISA KEV listing, the low attack complexity and zero user interaction requirement make this trivially abusable by any attacker who establishes a WebSocket connection before their credentials are revoked. Upgrade immediately to OpenClaw 2026.3.28 or later and audit all active WebSocket sessions for connections originating from revoked or deprovisioned credentials.

Is CVE-2026-34503 actively exploited?

No confirmed active exploitation of CVE-2026-34503 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-34503?

1. Upgrade OpenClaw to version 2026.3.28 or later (patch commit 7a801cc451e9e667b705eeccff651923a1b8c863). 2. As an immediate workaround on unpatched systems, restart the OpenClaw service to force session renegotiation and terminate all active WebSocket connections. 3. Implement network-layer WebSocket session monitoring to detect long-lived connections (greater than 24 hours) and correlate against the current valid token list. 4. Review audit logs for WebSocket sessions that were active after corresponding device removal or token revocation events to identify potential exploitation windows. 5. In high-risk environments, place OpenClaw behind an API gateway or reverse proxy that enforces session termination at the network layer independent of application-level revocation logic.

What systems are affected by CVE-2026-34503?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent orchestration platforms, multi-tool AI agent deployments, enterprise AI assistant platforms.

What is the CVSS score for CVE-2026-34503?

CVE-2026-34503 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.33%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent orchestration platformsmulti-tool AI agent deploymentsenterprise AI assistant platforms

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0053 AI Agent Tool Invocation

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: 8.4

NIST AI RMF: GOVERN 1.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.

Exploitation Scenario

An attacker with low-privilege access to an OpenClaw-based AI agent system establishes a WebSocket connection, either directly or via a compromised device enrolled in the platform. The victim organization detects the intrusion and revokes the attacker's credentials and removes the compromised device as part of incident response. However, because OpenClaw does not terminate existing WebSocket sessions on revocation, the attacker's connection remains live. The attacker now operates from what appears to administrators to be a fully contained threat, continuing to interact with connected AI agent tools, query LLM APIs, exfiltrate data via agent-accessible resources, and issue commands through the agent's tool stack. The persistent session effectively nullifies the containment phase of any IR playbook, allowing the attacker to operate undetected while remediation actions are considered complete.

Weaknesses (CWE)

CWE-613 Insufficient Session Expiration

CWE-613 — Insufficient Session Expiration: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."