CVE-2026-42421
type: TechArticle
description: OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation. Attackers can maintain unauthorized access to WebSocket connections after token rotation by exploiting the failure to disconnect existing shared-token sessions.
date published: 2026-04-28T19:37:45.820
license: https://creativecommons.org/publicdomain/zero/1.0/
source: https://nvd.nist.gov/vuln/detail/CVE-2026-42421
publisher: AI Analytics
source organization: NIST National Vulnerability Database
main entity: Thing
  additional type: Vulnerability
  score: 5.4
  severity: MEDIUM
keywords: CWE-613

AI Analytics
type: Organization