CVE-2026-42421CWE-613

OpenClaw < 2026.4.8 - WebSocket Session Persistence via Shared Gateway Token Rotation

Low · published April 28, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
24.2
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation. Attackers can maintain unauthorized access to WebSocket connections after token rotation by exploiting the failure to disconnect existing shared-token sessions.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00324 · 24.2th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-04-28T18:10Z
EPSS history
Timeline
  • 28 APR 18:10Z
    OpenClaw < 2026.4.8 - WebSocket Session Persistence via Shared Gateway Token Rotation
    cvelistv5