Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation. Attackers can maintain unauthorized access to WebSocket connections after token rotation by exploiting the failure to disconnect existing shared-token sessions.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-42421 Session Management Vulnerability in OpenClaw Before 2026.4.8 WebSocket Connections https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42421
Post summary
The text announces the CVE‑2026‑42421 session management flaw in OpenClaw WebSocket connections, providing a brief description but no zero‑day artifact or mitigation.
CVE-2026-42421 OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation. Attackers can maintain u… https://www.cve.org/CVERecord?id=CVE-2026-42421
Post summary
The post introduces a session management flaw in OpenClaw, detailing how WebSocket sessions persist after token rotation, but offers no evidence of exploitation, patches, or PoC code.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |