CVE-2026-28485

Katalog CVE

CVSS 7.8 · High EPSS 0,30%

Kerentanan Missing Authentication for Critical Function pada openclaw. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized local callers to invoke privileged operations. Remote attackers on the local network or local processes can execute arbitrary browser-context actions and access sensitive in-session data by sending requests to unauthenticated endpoints.

Rincian

Terbit di NVD

5 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 21,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-qpjj-47vm-64pj advisory vendor
• https://github.com/openclaw/openclaw/commit/9230a2ae14307740a13ada7afd6dcfab34e0287f patch
• https://www.vulncheck.com/advisories/openclaw-missing-authentication-in-browser-control-http-endpoints advisory pihak ketiga