CVE-2026-28485 OpenClaw 2026.1.5 < 2026.2.12 - Missing Authentication in Browser Control HTTP Endpoints

What is CVE-2026-28485?

CVE-2026-28485 is a high-severity missing authorization vulnerability in Openclaw Openclaw, published on 5 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized local callers to invoke privileged operations. Remote attackers on the local network or local processes can execute arbitrary browser-context actions and access sensitive in-session data by sending requests to unauthenticated endpoints.

Weakness: CWE-306

Which versions are affected by CVE-2026-28485?

It affects 1 product.

Products include Openclaw Openclaw.

How do I fix CVE-2026-28485?

No fix has been published for CVE-2026-28485 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-28485 being exploited?

There is no known exploitation of CVE-2026-28485 in the wild and no public exploit code.

Other vulnerabilities in Openclaw Openclaw

• CVE-2026-28363 Security feature bypass in OpenClaw Critical 9.9
• CVE-2026-30741 Code injection in n/a Critical 9.8
• CVE-2026-33579 OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval Critical 9.4
• CVE-2026-32922 OpenClaw < 2026.3.11 - Privilege Escalation via Unvalidated Scope in device.token.rotate Critical 9.4
• CVE-2026-32978 OpenClaw < 2026.3.11 - Approval Bypass via Unrecognized Script Runners Critical 9.4

All Openclaw Openclaw vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qpjj-47vm-64pj.