Vulnerabilities
CVE-2026-28485 - OpenClaw 2026.1.5 < 2026.2.12 - Missing Authentication in Browser Control HTTP E...
CVE ID : CVE-2026-28485 Published : March 5, 2026, 10:16 p.m. | 1 hour, 28 minutes ago Description : OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized local callers to invoke privileged operations. Remote attackers on the local network or local processes can execute arbitrary browser-context actions and access sensitive in-session data by sending requests to unauthenticated endpoints. Severity: 8.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...