CVE-2026-42421: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-42421 is a session management vulnerability in OpenClaw, a user-controlled local AI assistant, where existing WebSocket sessions survive shared gateway token rotation. Affected versions are all releases up to and including 2026.4.1 (npm package); the patched version is 2026.4.8. The vulnerability was published on April 28, 2026, with the fix committed on April 8, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 2.3 (Low) (GitHub Advisory, Feedly).

The root cause is classified as CWE-613 (Insufficient Session Expiration): when a shared gateway token is rotated, OpenClaw fails to terminate existing WebSocket sessions that were authenticated using the old token. This means an attacker who has already established a WebSocket connection using a shared gateway token can maintain that connection indefinitely, even after the token is rotated as a remediation or access-revocation measure. The vulnerability is scoped to OpenClaw's local trust model and does not assume a multi-tenant service boundary, meaning exploitation requires the attacker to have already obtained low-level access to initiate a WebSocket session. The fix (commit d7c3210) was applied to the main branch and includes targeted regression tests for the affected security boundary (GitHub Advisory, GitHub Commit).

Successful exploitation allows a low-privileged attacker to maintain unauthorized access to WebSocket connections after a gateway token rotation event, effectively bypassing the intended access revocation. This results in low-level impacts to both confidentiality and integrity — the attacker may continue to observe or interact with data and functionality exposed over the persistent WebSocket session. Availability is not impacted, and the vulnerability does not cross system or tenant boundaries given OpenClaw's local assistant trust model (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.025%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to already hold low-level privileges and have an established WebSocket session prior to token rotation (Feedly, GitHub Advisory).

1. Initial Access: Obtain low-privileged access to an OpenClaw instance (version ≤ 2026.4.1) and acquire a valid shared gateway token.
2. Establish WebSocket Session: Use the shared gateway token to open a WebSocket connection to the OpenClaw gateway endpoint before any token rotation occurs.
3. Trigger or Wait for Token Rotation: The legitimate administrator rotates the shared gateway token (e.g., as a security measure or routine credential update).
4. Maintain Persistent Access: Because OpenClaw does not disconnect existing WebSocket sessions upon token rotation, the attacker's session remains active and authenticated despite the token change.
5. Exploit Persistent Session: Continue to interact with the WebSocket connection to access data or functionality that should have been revoked, until the session is manually terminated or the server is restarted (GitHub Advisory).

• Network: Long-lived WebSocket connections to the OpenClaw gateway that persist across known token rotation events; connections originating from unexpected or unauthorized client IPs.
• Logs: OpenClaw access logs showing WebSocket sessions established with a token that has since been rotated, with no corresponding session termination event at the time of rotation.
• Process/Session: Active WebSocket sessions in the OpenClaw process that predate the most recent gateway token rotation and have not been re-authenticated with the new token.

Upgrade OpenClaw (npm) to version 2026.4.8 or later, which contains the fix committed at d7c3210cd6f5fdfdc1beff4c9541673e814354d5. As an interim workaround, administrators should manually restart the OpenClaw service or forcibly terminate all active WebSocket sessions immediately after rotating the shared gateway token to ensure no stale sessions persist. Additionally, implement monitoring to detect WebSocket connections that survive token rotation events, and review access controls for shared gateway tokens (GitHub Advisory, GitHub Commit).

The vulnerability was reported by @kexinoh of Tencent Zhuque Lab (AI-Infra-Guard project) and credited in the official GitHub Security Advisory. The advisory was published by OpenClaw maintainer steipete and rated as Moderate severity. No significant broader media coverage or notable community debate has been observed beyond standard CVE tracking and aggregator sites (GitHub Advisory).