CVE-2026-41356: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41356 is an insufficient session expiration vulnerability in OpenClaw (npm package) where the device.token.rotate gateway method fails to terminate active WebSocket sessions upon credential rotation. Affecting all versions up to and including 2026.3.28, the flaw was reported by zsxsoft (sponsored by KeenSecurityLab) and disclosed on April 23, 2026, with a fix released in version 2026.3.31. It carries a CVSS v3.1 score of 5.4 (Medium) and a CVSS v4.0 score of 2.3 (Low) (Github Advisory, GHSA-wwc3-c577-533m).

The root cause is classified as CWE-613 (Insufficient Session Expiration): when a device token is rotated via the device.token.rotate gateway method, the server issues new credentials but does not call disconnectClientsForDevice() to terminate existing authenticated WebSocket connections. This means an attacker who has previously compromised a device's credentials can maintain an active, authenticated WebSocket session indefinitely after the victim rotates their token — effectively bypassing the revocation mechanism. The fix, applied in commit 91f7a6b, adds a queueMicrotask call after a successful token rotation to invoke context.disconnectClientsForDevice(deviceId, { role }), forcibly closing all live connections associated with the rotated credential (Github Commit, Github Advisory).

An attacker who has previously obtained valid device credentials can persist unauthorized access to an OpenClaw gateway instance even after the legitimate owner rotates their token, as the attacker's existing WebSocket session remains open and authenticated. This results in low-level confidentiality impact (unauthorized data access through the persistent connection) and low-level integrity impact (ability to make unauthorized modifications via the live session). Availability is not affected, and there is no evidence of lateral movement potential beyond the scope of the compromised device's session (GHSA-wwc3-c577-533m, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.025% (0.000250), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires that an attacker has already compromised device credentials prior to a token rotation event, making this a post-compromise persistence mechanism rather than an initial access vector (Github Advisory, GHSA-wwc3-c577-533m).

1. Credential Compromise: Obtain valid device credentials (e.g., operator token) for an OpenClaw instance through phishing, credential stuffing, or another initial access technique.
2. Establish WebSocket Session: Using the compromised credentials, authenticate to the OpenClaw gateway and establish an active WebSocket connection.
3. Wait for Token Rotation: Monitor or wait for the legitimate device owner to invoke device.token.rotate to rotate their credentials (e.g., as a remediation action after suspecting compromise).
4. Maintain Persistent Access: Because the vulnerable versions (≤2026.3.28) do not call disconnectClientsForDevice upon rotation, the attacker's existing WebSocket session remains authenticated and active despite the credential change.
5. Exploit Persistent Session: Continue to send and receive data through the orphaned WebSocket connection, accessing confidential information or making unauthorized modifications within the scope of the original device's permissions (Github Advisory, Github Commit).

• Network: Long-lived WebSocket connections to the OpenClaw gateway originating from unexpected IP addresses, particularly connections that persist beyond a device.token.rotate event.
• Logs: Gateway access logs showing WebSocket sessions authenticated with a device token that has since been rotated (i.e., session established before a rotation timestamp but still active after it); audit log entries for device.token.rotate followed by continued activity on the same session.
• Process/Application: Unexpected device.token.rotate calls not initiated by the legitimate device owner; WebSocket sessions with unusually long durations compared to baseline behavior for the affected device.

Upgrade OpenClaw (npm) to version 2026.3.31 or later, which includes the fix that calls disconnectClientsForDevice after every successful token rotation, immediately terminating all active WebSocket sessions for the affected device. As an interim measure for organizations unable to patch immediately, manually restart the OpenClaw gateway service after performing any token rotation to force all active sessions to close. Additionally, implement monitoring and alerting on WebSocket session durations and device.token.rotate events to detect anomalous persistent connections (Github Advisory, Github Commit).