VulnerabilityAnalyzed

CVE-2026-41356

Attackers with previously compromised credentials can maintain unauthorized access through existing WebSocket connections after token rotation.

LOW 2.3EPSS 0.19%

Does this matter?

Lower severity and a low EPSS score (0.19%). Track it; it rarely justifies an emergency change on its own.

Description

OpenClaw before 2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens. Attackers with previously compromised credentials can maintain unauthorized access through existing WebSocket connections after token rotation.

CVSS 4.0: 2.3 LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.19% probability · 8th percentile
CISA KEV: Not listed
Weakness: CWE-613
Affected: openclaw/openclaw
Source: disclosure@vulncheck.com

References

https://github.com/openclaw/openclaw/commit/91f7a6b0fd67b703897e6e307762d471ca09333dPatch
https://github.com/openclaw/openclaw/security/advisories/GHSA-rfqg-qgf8-xr9xVendor Advisory
https://www.vulncheck.com/advisories/openclaw-incomplete-websocket-session-termination-in-device-token-rotateThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.