Executive Summary

CVE-2026-42421 is a session management vulnerability in OpenClaw versions before 2026.4.8. The issue occurs because existing WebSocket sessions remain active even after the shared gateway token is rotated.

This means that when the token used to authenticate WebSocket connections is changed, the old sessions authenticated with the previous token are not disconnected as expected.

Attackers can exploit this flaw to maintain unauthorized access to WebSocket connections by continuing to use sessions tied to the old token.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to maintain unauthorized access to WebSocket connections even after token rotation, which is intended to invalidate old sessions.

As a result, an attacker with low privileges and no user interaction can persist in accessing or interacting with the system beyond the intended session lifetime.

The impact includes partial compromise of confidentiality and integrity of the WebSocket communication, but it does not affect availability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability involves insufficient session expiration, allowing unauthorized access to WebSocket sessions after token rotation. This could potentially lead to unauthorized access to sensitive data or systems.

Such unauthorized access risks may impact compliance with standards and regulations like GDPR or HIPAA, which require strict controls on session management and access to protect personal or sensitive information.

However, the provided information does not explicitly state the direct impact on compliance with these regulations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves existing WebSocket sessions persisting after shared gateway token rotation, allowing unauthorized access. Detection would involve monitoring WebSocket connections to see if sessions authenticated with old tokens remain active after token rotation.

Specific commands or detection methods are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade OpenClaw to version 2026.4.8 or later, where the vulnerability has been fixed.

This update ensures that existing WebSocket sessions are properly disconnected upon shared gateway token rotation, preventing unauthorized session persistence.

Useful 0 Not Useful 0