PT-2026-35800 · Openclaw · Openclaw

Kexna · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-42421

NVD

CVSS v3.1

5.4

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation. Attackers can maintain unauthorized access to WebSocket connections after token rotation by exploiting the failure to disconnect existing shared-token sessions.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-42421

Affected Products

Openclaw

References · 5

• https://github.com/openclaw/openclaw/security/advisories/GHSA-5h3f-885m-v22w · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42421 · Security Note
• https://vulncheck.com/advisories/openclaw-websocket-session-persistence-via-shared-gateway-token-rotation · Note
• https://twitter.com/CVEnew/status/2049227502371914058 · Twitter Post