CVE-2026-41356
CVE-2026-41356 · OpenClaw < 2026.3.31 - Incomplete WebSocket Session Termination in device.token.rotate
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenClaw before 2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens. Attackers with previously compromised credentials can maintain unauthorized access through existing WebSocket connections after token rotation.
CVSS 2.3 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
Original sources
- https://github.com/openclaw/openclaw/security/advisories/GHSA-rfqg-qgf8-xr9x
- https://github.com/openclaw/openclaw/commit/91f7a6b0fd67b703897e6e307762d471ca09333d
- https://www.vulncheck.com/advisories/openclaw-incomplete-websocket-session-termination-in-device-token-rotate
- https://nvd.nist.gov/vuln/detail/CVE-2026-41356