https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T23:39:59.921336+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-41356 CVE-2026-41356 — OpenClaw < 2026.3.31 - Incomplete WebSocket Session Termination in device.token.rotate 2026-10-03T23:39:59.951183+00:00

Affected: OpenClaw

OpenClaw before 2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens. Attackers with previously compromised credentials can maintain unauthorized access through existing WebSocket connections after token rotation.

 https://cve.radiocsirt.org/vuln/ghsa-rfqg-qgf8-xr9x GHSA-rfqg-qgf8-xr9x — OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation 2026-10-03T23:39:59.951262+00:00

Affected: npm: openclaw

## Summary Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation

## Current Maintainer Triage - Status: open - Normalized severity: low - Assessment: v2026.3.28 rotates device tokens without disconnecting already-authenticated WebSocket sessions, which is a real but post-compromise revocation gap.

## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version: `2026.3.31` - Vulnerable version range: `<=2026.3.28` - Patched versions: `>= 2026.3.31` - First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s) - `91f7a6b0fd67b703897e6e307762d471ca09333d` — 2026-03-31T09:05:34+09:00

## Release Process Note - The fix is already present in released version `2026.3.31`. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @zsxsoft for reporting.