CVE-2026-41356
Medium · 5.4CVSS
5.4
EPSS
0.3%
Published
Apr 23, 2026
CISA due date
—
The record
OpenClaw before 2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens. Attackers with previously compromised credentials can maintain unauthorized access through existing WebSocket connections after token rotation.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | openclaw | 0 | 2026.3.31 |
Related vulnerabilities
- GHSA-rfqg-qgf8-xr9x OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions… Same vulnerability
- GHSA-4hpg-mp64-x7xq OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state Also affects openclaw
- GHSA-8mg9-j9cf-54cj OpenClaw: Empty-scope device re-pairing could confuse caller scope containment Also affects openclaw
- GHSA-rx78-29qr-5hq8 OpenClaw: Workspace-derived service PATH could influence trash command selection Also affects openclaw
- GHSA-wc84-j36w-pw4x OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots Also affects openclaw
- GHSA-cw4q-gqg5-g38h OpenClaw: Discord allowFrom could bind to mutable display names Also affects openclaw
- GHSA-mpc8-jxjh-qpgh OpenClaw: Focus command could miss controlScope enforcement Also affects openclaw
- GHSA-24vr-rprv-67rf OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install Also affects openclaw