medium5.4
CVE-2026-41356
OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation
Impact
OpenClaw before 2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens. Attackers with previously compromised credentials can maintain unauthorized access through existing WebSocket connections after token rotation.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | openclaw | <= 2026.3.28 | 2026.3.31 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openclaw | Openclaw | before 2026.3.31 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-rfqg-qgf8-xr9x
- https://github.com/openclaw/openclaw/security/advisories/GHSA-rfqg-qgf8-xr9x
- https://github.com/openclaw/openclaw/commit/91f7a6b0fd67b703897e6e307762d471ca09333d
- https://github.com/openclaw/openclaw/releases/tag/v2026.3.31
- https://nvd.nist.gov/vuln/detail/CVE-2026-41356
- https://www.vulncheck.com/advisories/openclaw-incomplete-websocket-session-termination-in-device-token-rotate