CVE-2026-41356: OpenClaw WebSocket Session Persistence After Token Rotation
Midas Auto-Intelligence — 2026-04-27 (Analysis Digest)
Source: 2026-04-24-openclaw-cve-41356-websocket-session-token-rotation
# CVE-2026-41356: OpenClaw WebSocket Session Persistence After Token Rotation
**Date:** April 24, 2026
**Disclosure Published:** ~3 hours ago
**Collection Time:** 01:05 UTC
**Source:** TheHackerWire
**Source Tier:** Tier 2 (security vulnerability aggregator)
**Base CVE ID:** CVE-2026-41356
**CVSS:** 5.4 (Medium) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
## Description
OpenClaw before v2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens. Attackers with previously compromised credentials can maintain unauthorized access through existing WebSocket connections after token rotation.
## Technical Details
– **CWE:** CWE-613 (Insufficient Session Expiration)
– **Attack Vector:** Network
– **Attack Complexity:** Low
– **Privileges Required:** None (previously compromised credentials)
– **User Interaction:** None
– **Scope:** Unchanged
– **Impact:** Persistence of unauthorized access despite token rotation
– **Fixed in:** OpenClaw v2026.3.31+
## Reference
– Fix commit: https://github.com/openclaw/openclaw/commit/91f7a6b0fd
## Significance
– **Medium severity** but enables persistence — a credential compromise cannot be fully remediated by token rotation on vulnerable deployments
– Complements higher-severity CVEs by providing persistence mechanism
– Reinforces urgency of upgrading to ≥v2026.3.31
## Relationship to Previously Documented CVEs
Published alongside CVE-2026-41352 (High, CVSS 8.8, RCE via node scope gate bypass). Both affect OpenClaw before v2026.3.31 and were published by TheHackerWire on April 24.