CVE-2026-42421
OpenClaw < 2026.4.8 - WebSocket Session Persistence via Shared Gateway Token Rotation
Summary
OpenClaw < 2026.4.8 - WebSocket Session Persistence via Shared Gateway Token Rotation
Original description
The description as published by the source.
OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation. Attackers can maintain unauthorized access to WebSocket connections after token rotation by exploiting the failure to disconnect existing shared-token sessions.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com
- patch github.com