CVE-2026-41356

弱点类型

OpenClaw before 2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens. Attackers with previously compromised credentials can maintain unauthorized access through existing WebSocket connections after token rotation.

受影响产品

• openclaw openclaw

参考链接

• https://github.com/openclaw/openclaw/commit/91f7a6b0fd67b703897e6e307762d471ca09333d
• https://github.com/openclaw/openclaw/security/advisories/GHSA-rfqg-qgf8-xr9x
• https://www.vulncheck.com/advisories/openclaw-incomplete-websocket-session-termination-in-device-token-rotate