CVE-2026-42421: Openclaw Auth Bypass Vulnerability

CVE-2026-42421 Overview

CVE-2026-42421 is a session management vulnerability in OpenClaw before version 2026.4.8 that allows existing WebSocket sessions to survive shared gateway token rotation. This vulnerability enables attackers to maintain unauthorized access to WebSocket connections after token rotation by exploiting the failure to disconnect existing shared-token sessions.

Critical Impact
Attackers who have obtained a shared gateway token can maintain persistent WebSocket connections even after security teams rotate the compromised token, undermining token-based access revocation mechanisms.

Affected Products

OpenClaw versions prior to 2026.4.8
OpenClaw Node.js package (all vulnerable versions)

Discovery Timeline

2026-04-28 - CVE-2026-42421 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-42421

Vulnerability Analysis

This vulnerability stems from inadequate session termination logic in OpenClaw's WebSocket session management. When a shared gateway token is rotated—typically in response to a suspected compromise—the application fails to invalidate and disconnect WebSocket sessions that were established using the old token. This creates a window where an attacker who has already established a WebSocket connection can continue to operate with full access privileges despite the token rotation intended to revoke their access.

The vulnerability is classified under CWE-613 (Insufficient Session Expiration), indicating that the application does not properly handle the lifecycle of authenticated sessions in relation to credential changes.

Root Cause

The root cause is the decoupling between token validation at connection establishment and session persistence management. WebSocket connections are authenticated once at the handshake phase, and subsequent communication does not re-validate the token against the current valid token set. When the shared gateway token is rotated, existing sessions continue to operate without awareness of the invalidation event.

Attack Vector

An attacker who has obtained a valid shared gateway token—through credential theft, insider access, or other means—can establish a WebSocket connection to the OpenClaw service. Even after security administrators detect the compromise and rotate the shared token, the attacker's established WebSocket session remains active and functional. This persistence undermines incident response procedures that rely on token rotation as a remediation measure.

The attack requires network access and an authenticated session (low privileges), but the presence-required condition and the low confidentiality/integrity impact contribute to the overall low severity classification.

typescript

     try {
       assertExplicitProxySupportsPinnedDns(parsedUrl, params.dispatcherPolicy, params.pinDns);
       await assertExplicitProxyAllowed(params.dispatcherPolicy, params.lookupFn, params.policy);
-      const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
-        lookupFn: params.lookupFn,
-        policy: params.policy,
-      });
       const canUseTrustedEnvProxy =
         mode === GUARDED_FETCH_MODE.TRUSTED_ENV_PROXY && hasProxyEnvConfigured();
       if (canUseTrustedEnvProxy) {
         dispatcher = createHttp1EnvHttpProxyAgent();
       } else if (params.pinDns === false) {
         dispatcher = createPolicyDispatcherWithoutPinnedDns(params.dispatcherPolicy);
       } else {
+        const pinned = await resolvePinnedHostnameWithPolicy(parsedUrl.hostname, {
+          lookupFn: params.lookupFn,
+          policy: params.policy,
+        });
         dispatcher = createPinnedDispatcher(pinned, params.dispatcherPolicy, params.policy);
       }

Source: GitHub Commit Update

Detection Methods for CVE-2026-42421

Indicators of Compromise

WebSocket sessions that remain active beyond the timestamp of a token rotation event
Connections using invalidated or rotated shared gateway tokens
Unusual session persistence patterns in WebSocket connection logs

Detection Strategies

Monitor WebSocket connection metadata and correlate session establishment times with token rotation events
Implement logging for all token rotation events and cross-reference with active session inventories
Deploy network monitoring to identify WebSocket sessions that persist after credential rotation operations

Monitoring Recommendations

Enable detailed session logging for all WebSocket connections including token identifiers
Set up alerts for sessions that exceed expected token validity windows
Conduct periodic audits of active WebSocket sessions against valid token registries

How to Mitigate CVE-2026-42421

Immediate Actions Required

Upgrade OpenClaw to version 2026.4.8 or later immediately
After token rotation, manually terminate all existing WebSocket sessions as a precautionary measure
Review WebSocket connection logs for any suspicious persistent sessions

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.4.8. The fix ensures that WebSocket sessions are properly terminated when the associated shared gateway token is rotated. Organizations should review the GitHub Security Advisory and the commit details for implementation specifics.

Workarounds

Implement a session termination script that forcibly disconnects all WebSocket sessions whenever a token rotation occurs
Deploy a reverse proxy or API gateway that can enforce session re-authentication on token change events
Reduce the shared gateway token lifetime to minimize the exposure window

bash

# Example: Force terminate all active WebSocket sessions after token rotation
# This is a temporary workaround until patch is applied
openclaw-cli sessions terminate --all --reason "token-rotation"