CVE-2026-28472 — OpenClaw versions prior to 2026.2.2 contain a vulnerability in the gateway WebSocket…¶

Key facts

CVE-2026-28472 is a High (8.1) vulnerability: OpenClaw versions prior to 2026.2.2 contain a vulnerability in the gateway WebSocket…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2026-28472
Severity	High (8.1)
Detection / prevention	Snort, YARA, Nginx, Apache, Sigma
PoC	poc.py
Source	2026/CVE-2026-28472/

Details¶

CVE-2026-28472 is a High (8.1) vulnerability: OpenClaw versions prior to 2026.2.2 contain a vulnerability in the gateway WebSocket…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description¶

OpenClaw versions prior to 2026.2.2 contain a vulnerability in the gateway WebSocket connect handshake in which it allows skipping device identity checks when auth.token is present but not validated. Attackers can connect to the gateway without providing device identity or pairing by exploiting the presence check instead of validation, potentially gaining operator access in vulnerable deployments.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2026-28472
CVSS Score	8.1

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2026/CVE-2026-28472/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2026-28472

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References¶

https://github.com/openclaw/openclaw/commit/fe81b1d7125a014b8280da461f34efbf5f761575
https://github.com/openclaw/openclaw/security/advisories/GHSA-rv39-79c4-7459
https://www.vulncheck.com/advisories/openclaw-device-identity-check-bypass-in-gateway-websocket-connect-handshake

Generated by PoC Generator on 2026-04-10T16:17:09.682908273

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2026-28472, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2026-28472 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

alert tcp any any -> any 80 (msg:"CVE-2026-28472 OpenClaw WebSocket handshake auth bypass attempt"; flow:established,to_server; content:"GET"; http_method; content:"Upgrade|3a 20|websocket"; http_header; content:"auth.token"; http_header; content:!"device"; http_header; classtype:attempted-admin; sid:1000000; rev:1; priority:1;)

alert tcp any any -> any 443 (msg:"CVE-2026-28472 OpenClaw WebSocket handshake auth bypass attempt SSL"; flow:established,to_server; content:"GET"; http_method; content:"Upgrade|3a 20|websocket"; http_header; content:"auth.token"; http_header; content:!"device"; http_header; classtype:attempted-admin; sid:1000001; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-28472 OpenClaw gateway WebSocket connect without device identity"; flow:established,to_server; content:"Connection|3a 20|Upgrade"; http_header; content:"Upgrade|3a 20|websocket"; http_header; content:"auth.token"; http_header; content:!"device_id"; http_header; content:!"pairing"; http_header; classtype:attempted-admin; sid:1000002; rev:1; priority:1;)

alert tcp any any -> any any (msg:"CVE-2026-28472 OpenClaw WebSocket auth token presence check bypass"; flow:established,to_server; content:"Sec-WebSocket-Protocol"; http_header; content:"auth.token="; http_header; pcre:"/auth\.token=[^&\s]+/i"; content:!"device_identity"; http_header; classtype:attempted-admin; sid:1000003; rev:1; priority:1;)

:material-file-download: prevention/snort.rules

rule CVE_2026_28472_OpenClaw_WebSocket_Auth_Bypass {
    meta:
        author = "Security Engineer"
        description = "Detects exploitation attempts for CVE-2026-28472 - OpenClaw WebSocket authentication bypass vulnerability"
        cve = "CVE-2026-28472"
        date = "2024-12-19"
        severity = "high"
        reference = "OpenClaw gateway WebSocket connect handshake auth bypass"

    strings:
        $ws_handshake1 = "Upgrade: websocket" nocase
        $ws_handshake2 = "Connection: Upgrade" nocase
        $auth_token1 = "auth.token" nocase
        $auth_token2 = "auth_token" nocase
        $openclaw1 = "openclaw" nocase
        $openclaw2 = "OpenClaw" nocase
        $gateway1 = "gateway" nocase
        $device_identity1 = "device_identity" nocase
        $device_identity2 = "deviceIdentity" nocase
        $pairing1 = "pairing" nocase
        $operator1 = "operator" nocase

        // Hex patterns for WebSocket upgrade headers
        $hex_ws_upgrade = { 55 70 67 72 61 64 65 3A 20 77 65 62 73 6F 63 6B 65 74 }
        $hex_connection_upgrade = { 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 55 70 67 72 61 64 65 }

        // Suspicious auth bypass patterns
        $bypass1 = /auth\.token.*present.*not.*validat/i
        $bypass2 = /skip.*device.*identity.*check/i
        $bypass3 = /presence.*check.*validation/i
        $bypass4 = /auth.*token.*bypass/i

        // WebSocket connection patterns without proper validation
        $exploit1 = /connect.*gateway.*auth\.token.*[^v]alidat/i
        $exploit2 = /websocket.*handshake.*device.*identity.*skip/i
        $exploit3 = /operator.*access.*without.*device/i

    condition:
        (
            // WebSocket handshake indicators
            ($ws_handshake1 and $ws_handshake2) or 
            ($hex_ws_upgrade or $hex_connection_upgrade)
        ) and
        (
            // OpenClaw gateway context
            ($openclaw1 or $openclaw2) and $gateway1
        ) and
        (
            // Authentication bypass indicators
            ($auth_token1 or $auth_token2) and
            (
                $bypass1 or $bypass2 or $bypass3 or $bypass4 or
                $exploit1 or $exploit2 or $exploit3 or
                ($device_identity1 or $device_identity2) or
                ($pairing1 and $operator1)
            )
        )
}

rule CVE_2026_28472_OpenClaw_Exploit_Network_Traffic {
    meta:
        author = "Security Engineer"
        description = "Detects network traffic patterns exploiting CVE-2026-28472"
        cve = "CVE-2026-28472"
        date = "2024-12-19"
        severity = "high"

    strings:
        $http_header1 = "GET" nocase
        $http_header2 = "POST" nocase
        $ws_key = "Sec-WebSocket-Key:" nocase
        $ws_version = "Sec-WebSocket-Version:" nocase
        $ws_protocol = "Sec-WebSocket-Protocol:" nocase

        $malicious_token1 = /auth\.token["\s]*[:=]["\s]*[^"\s&]*["\s&]/i
        $malicious_token2 = /auth_token["\s]*[:=]["\s]*[^"\s&]*["\s&]/i

        $missing_device_id1 = /device.*id.*null/i
        $missing_device_id2 = /deviceIdentity.*["\s]*[:=]["\s]*["\s]*["}]/i
        $empty_pairing = /pairing.*["\s]*[:=]["\s]*["\s]*["}]/i

        $openclaw_endpoint1 = "/gateway/ws" nocase
        $openclaw_endpoint2 = "/api/gateway" nocase
        $openclaw_endpoint3 = "/openclaw/gateway" nocase

    condition:
        (
            ($http_header1 or $http_header2) and
            ($ws_key or $ws_version or $ws_protocol)
        ) and
        (
            $malicious_token1 or $malicious_token2
        ) and
        (
            $missing_device_id1 or $missing_device_id2 or $empty_pairing or
            $openclaw_endpoint1 or $openclaw_endpoint2 or $openclaw_endpoint3
        )
}

rule CVE_2026_28472_OpenClaw_Version_Vulnerable {
    meta:
        author = "Security Engineer"
        description = "Detects vulnerable OpenClaw versions affected by CVE-2026-28472"
        cve = "CVE-2026-28472"
        date = "2024-12-19"
        severity = "medium"

    strings:
        $version_pattern1 = /OpenClaw["\s]*[:\-\s]*["\s]*[0-9]+\.[0-9]+\.[0-9]+/i
        $version_pattern2 = /openclaw["\s]*[:\-\s]*["\s]*v?[0-9]+\.[0-9]+\.[0-9]+/i

        // Vulnerable version patterns (prior to 2026.2.2)
        $vuln_version1 = /2026\.[0-1]\.[0-9]+/
        $vuln_version2 = /2026\.2\.[0-1]/
        $vuln_version3 = /202[0-5]\.[0-9]+\.[0-9]+/

        $gateway_component = "gateway" nocase
        $websocket_component = "websocket" nocase

    condition:
        (
            $version_pattern1 or $version_pattern2
        ) and
        (
            $vuln_version1 or $vuln_version2 or $vuln_version3
        ) and
        (
            $gateway_component and $websocket_component
        )
}

:material-file-download: prevention/yara.yar

# CVE-2026-28472 - OpenClaw Gateway WebSocket Authentication Bypass Prevention

# Block WebSocket upgrade requests to OpenClaw gateway endpoints without proper validation
location ~* ^/(gateway|websocket|ws)/ {
    # Block requests with auth.token parameter but missing device identity
    if ($args ~ "auth\.token=([^&]+)") {
        set $has_auth_token 1;
    }

    # Check for device identity parameters
    if ($args !~ "(device_id|device_identity|pairing_key)=") {
        set $missing_device_identity 1;
    }

    # Block if auth.token exists but device identity is missing
    if ($has_auth_token$missing_device_identity = "11") {
        return 403;
    }

    # Block WebSocket connections with incomplete authentication
    if ($http_upgrade ~* "websocket") {
        if ($args ~ "auth\.token=" && $args !~ "device_id=") {
            return 403;
        }
    }

    # Require proper Content-Type and authentication headers
    if ($request_method = "POST") {
        if ($content_type !~ "application/(json|x-www-form-urlencoded)") {
            return 400;
        }
    }

    # Add security headers
    add_header X-Frame-Options "DENY" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    proxy_pass $backend;
}

# Block direct access to OpenClaw gateway handshake endpoints
location ~* ^/(api/)?gateway/(connect|handshake|auth)/?$ {
    # Validate required authentication parameters
    if ($args !~ "device_id=[a-zA-Z0-9\-]+") {
        return 403;
    }

    if ($args !~ "pairing_key=[a-zA-Z0-9\-_]+") {
        return 403;
    }

    # Block malformed auth.token patterns that bypass validation
    if ($args ~ "auth\.token=[^&]*[;&]") {
        return 400;
    }

    if ($args ~ "auth\.token=(\s|%20|null|undefined|false)") {
        return 400;
    }

    proxy_pass $backend;
}

# Rate limiting for WebSocket connection attempts
location ~* \.(ws|websocket)$ {
    limit_req zone=websocket_limit burst=10 nodelay;

    # Validate WebSocket upgrade headers
    if ($http_upgrade != "websocket") {
        return 426;
    }

    if ($http_connection !~* "upgrade") {
        return 400;
    }

    # Block suspicious User-Agent patterns
    if ($http_user_agent ~* "(bot|crawler|scanner|exploit)") {
        return 403;
    }

    proxy_pass $backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}

# Block requests with malformed authentication bypass attempts
location / {
    # Block auth token presence check bypasses
    if ($args ~ "auth\.token=([^&]*&auth\.token=|.*\|\||.*&&)") {
        return 403;
    }

    # Block SQL injection attempts in auth parameters
    if ($args ~ "(auth\.token|device_id)=.*('|\"|;|--|\|)") {
        return 403;
    }

    # Block command injection attempts
    if ($args ~ "(auth\.token|device_id)=.*(&&|\|\||;|`|\$\()") {
        return 403;
    }
}

:material-file-download: prevention/nginx.conf

# ModSecurity rules for CVE-2026-28472 - OpenClaw WebSocket Authentication Bypass
# Prevents exploitation of authentication bypass in OpenClaw gateway WebSocket connections

# Rule 1000000: Block WebSocket upgrade requests with auth.token but missing device identity
SecRule REQUEST_HEADERS:Upgrade "@streq websocket" \
    "id:1000000,\
    phase:2,\
    block,\
    msg:'CVE-2026-28472: OpenClaw WebSocket authentication bypass attempt - auth.token present without device identity',\
    logdata:'URI: %{REQUEST_URI}, User-Agent: %{REQUEST_HEADERS.User-Agent}',\
    severity:CRITICAL,\
    tag:'cve-2026-28472',\
    tag:'websocket-bypass',\
    chain"
    SecRule ARGS:auth.token "!@streq " \
        "chain"
    SecRule &ARGS:device_id "@eq 0"

# Rule 1000001: Block WebSocket upgrade requests with auth.token but empty device_id
SecRule REQUEST_HEADERS:Upgrade "@streq websocket" \
    "id:1000001,\
    phase:2,\
    block,\
    msg:'CVE-2026-28472: OpenClaw WebSocket authentication bypass attempt - empty device_id with auth.token',\
    logdata:'URI: %{REQUEST_URI}, Auth Token: %{ARGS.auth.token}',\
    severity:CRITICAL,\
    tag:'cve-2026-28472',\
    tag:'websocket-bypass',\
    chain"
    SecRule ARGS:auth.token "!@streq " \
        "chain"
    SecRule ARGS:device_id "@streq "

# Rule 1000002: Block WebSocket requests to OpenClaw gateway paths without proper device pairing
SecRule REQUEST_URI "@beginsWith /gateway" \
    "id:1000002,\
    phase:2,\
    block,\
    msg:'CVE-2026-28472: OpenClaw gateway access without device pairing validation',\
    logdata:'URI: %{REQUEST_URI}, Connection: %{REQUEST_HEADERS.Connection}',\
    severity:HIGH,\
    tag:'cve-2026-28472',\
    tag:'gateway-bypass',\
    chain"
    SecRule REQUEST_HEADERS:Connection "@contains upgrade" \
        "chain"
    SecRule ARGS:auth.token "!@streq " \
        "chain"
    SecRule &ARGS:pairing_code "@eq 0"

# Rule 1000003: Detect suspicious WebSocket handshake patterns with auth.token manipulation
SecRule REQUEST_HEADERS:Upgrade "@streq websocket" \
    "id:1000003,\
    phase:2,\
    block,\
    msg:'CVE-2026-28472: Suspicious OpenClaw WebSocket handshake pattern detected',\
    logdata:'URI: %{REQUEST_URI}, Sec-WebSocket-Key: %{REQUEST_HEADERS.Sec-WebSocket-Key}',\
    severity:HIGH,\
    tag:'cve-2026-28472',\
    tag:'suspicious-handshake',\
    chain"
    SecRule QUERY_STRING "@contains auth.token" \
        "chain"
    SecRule QUERY_STRING "!@contains device_id" \
        "chain"
    SecRule QUERY_STRING "!@contains pairing"

# Rule 1000004: Block requests with malformed or suspicious auth.token values
SecRule ARGS:auth.token "@rx ^(?:[a-zA-Z0-9+/]{4})*(?:[a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=)?$" \
    "id:1000004,\
    phase:2,\
    pass,\
    nolog,\
    tag:'cve-2026-28472',\
    skipAfter:END_AUTH_TOKEN_CHECK"

SecRule ARGS:auth.token "!@streq " \
    "id:1000005,\
    phase:2,\
    block,\
    msg:'CVE-2026-28472: Invalid auth.token format in OpenClaw request',\
    logdata:'Invalid Token: %{ARGS.auth.token}',\
    severity:MEDIUM,\
    tag:'cve-2026-28472',\
    tag:'invalid-token'"

SecMarker END_AUTH_TOKEN_CHECK

# Rule 1000006: Monitor and log OpenClaw WebSocket connection attempts for analysis
SecRule REQUEST_HEADERS:User-Agent "@contains OpenClaw" \
    "id:1000006,\
    phase:2,\
    pass,\
    msg:'CVE-2026-28472: OpenClaw WebSocket connection attempt logged',\
    logdata:'URI: %{REQUEST_URI}, Method: %{REQUEST_METHOD}, Args: %{ARGS}',\
    severity:INFO,\
    tag:'cve-2026-28472',\
    tag:'openclaw-monitoring',\
    chain"
    SecRule REQUEST_HEADERS:Connection "@contains upgrade"

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2026-28472?¶

CVE-2026-28472 is a High (8.1) vulnerability: OpenClaw versions prior to 2026.2.2 contain a vulnerability in the gateway WebSocket…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-28472?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-28472?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

For authorized security testing and research only. See the full source and NVD record.