Description
OpenClaw before 2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens. Attackers with previously compromised credentials can maintain unauthorized access through existing WebSocket connections after token rotation.
Published: 2026-04-23
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Persistent unauthorized access via open WebSocket connections
Action: Apply Patch
AI Analysis

Impact

OpenClaw implementations before version 2026.3.31 fail to terminate active WebSocket sessions when the device token is rotated. The flaw permits an attacker who has already obtained valid credentials to maintain persistent unauthorized access through the existing WebSocket connections after the token change. This is a session-management weakness identified as CWE‑613.

Affected Systems

The vulnerability affects the OpenClaw product from OpenClaw, impacting all releases older than 2026.3.31 that use the device.token.rotate API. No specific distribution channel or additional products are listed.

Risk and Exploitability

The CVSS score of 2.3 indicates a low severity impact. The EPSS score is less than 1 %, suggesting a low probability of exploitation in the wild. The vulnerability is not registered in the CISA KEV catalog. Attackers would need to be already compromised to exploit the flaw and rely on the persistence of open WebSocket connections. No public exploits are known.

Generated by OpenCVE AI on April 28, 2026 at 07:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade OpenClaw to version 2026.3.31 or newer.
  • As a temporary measure, manually terminate all active WebSocket connections or restart the WebSocket service after rotating device tokens.
  • Verify that token rotation operations are protected by proper authentication and confirm that session termination occurs; consider disabling or monitoring WebSocket traffic until an official fix is applied.

Generated by OpenCVE AI on April 28, 2026 at 07:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-rfqg-qgf8-xr9x OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation
History

Fri, 24 Apr 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 23 Apr 2026 22:15:00 +0000

Type Values Removed Values Added
Description OpenClaw before 2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens. Attackers with previously compromised credentials can maintain unauthorized access through existing WebSocket connections after token rotation.
Title OpenClaw < 2026.3.31 - Incomplete WebSocket Session Termination in device.token.rotate
First Time appeared Openclaw
Openclaw openclaw
Weaknesses CWE-613
CPEs cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
Vendors & Products Openclaw
Openclaw openclaw
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Openclaw Openclaw
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-04-24T18:19:04.983Z

Reserved: 2026-04-20T14:07:26.649Z

Link: CVE-2026-41356

cve-icon Vulnrichment

Updated: 2026-04-24T16:50:19.293Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-23T22:16:43.007

Modified: 2026-04-29T14:08:59.547

Link: CVE-2026-41356

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T07:30:26Z

Weaknesses