CVE-2026-42421
OpenClaw < 2026.4.8 - WebSocket Session Persistence via Shared Gateway Token Rotation
Résumé
OpenClaw < 2026.4.8 - WebSocket Session Persistence via Shared Gateway Token Rotation
Description d'origine
La description telle que publiée par la source (souvent en anglais).
OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation. Attackers can maintain unauthorized access to WebSocket connections after token rotation by exploiting the failure to disconnect existing shared-token sessions.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com
- patch github.com