PT-2026-34787 · Openclaw · Openclaw

Keensecuritylab · Published 2026-04-03 · Updated 2026-04-25 · CVE-2026-41356

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description The software fails to terminate active WebSocket sessions during the rotation of device tokens. This allows attackers who possess previously compromised credentials to maintain unauthorized access via existing WebSocket connections even after the tokens have been rotated.

Recommendations Update to version 2026.3.31.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-41356

GHSA-RFQG-QGF8-XR9X

GHSA-WWC3-C577-533M

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/security/advisories/GHSA-rfqg-qgf8-xr9x · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/91f7a6b0fd67b703897e6e307762d471ca09333d · Patch
• https://osv.dev/vulnerability/GHSA-rfqg-qgf8-xr9x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41356 · Security Note
• https://osv.dev/vulnerability/GHSA-wwc3-c577-533m · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 · Note
• https://vulncheck.com/advisories/openclaw-incomplete-websocket-session-termination-in-device-token-rotate · Note
• https://twitter.com/CVEnew/status/2048168352871526544 · Twitter Post