CVE-2026-42421: OpenClaw < 2026.4.8 - WebSocket Session Persistence via Shared Gateway Token Rotation
OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation. Attackers can maintain unauthorized access to WebSocket connections after token rotation by exploiting the failure to disconnect existing shared-token sessions.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42421?
CVE-2026-42421 is classified as a significant security vulnerability due to its potential for unauthorized access to WebSocket sessions.
How do I fix CVE-2026-42421?
To fix CVE-2026-42421, upgrade OpenClaw to version 2026.4.8 or later, which addresses the session management vulnerability.
What systems are affected by CVE-2026-42421?
CVE-2026-42421 affects OpenClaw versions prior to 2026.4.8 that utilize WebSocket connections.
What type of vulnerability is CVE-2026-42421?
CVE-2026-42421 is a session management vulnerability related to WebSocket session persistence.
Can CVE-2026-42421 lead to data breaches?
Yes, if exploited, CVE-2026-42421 can allow attackers to maintain unauthorized access, potentially leading to data breaches.