VULNERABILITY INTELLIGENCE

CVE-2026-41356

CVSS score2.3 LOW
EPSS probability0.19%
CISA KEVNot currently listed
Published2026-04-23
Last modified2026-06-17
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Description

OpenClaw before 2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens. Attackers with previously compromised credentials can maintain unauthorized access through existing WebSocket connections after token rotation.

Weakness classification

  • CWE-613: Insufficient Session Expiration

Primary references