Is there a patch available for CVE-2026-42421?

Yes, a patch is available for CVE-2026-42421. Update the affected software to the latest version immediately.

OpenClaw CVE-2026-42421

Q: What is the CVSS score of CVE-2026-42421?

CVE-2026-42421 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26124 LOW

Insufficient Session Expiration (CWE-613)

2026-04-28 VulnCheck

Authentication Bypass Openclaw

2.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.2 MEDIUM

AC:H because exploitation requires a pre-existing authenticated session aligned with a concurrent token rotation event; PR:L for the required shared-token credential; no availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 04:18 vuln.today

Analysis Generated

Jul 24, 2026 - 04:18 vuln.today

Severity Changed

Apr 28, 2026 - 19:52 NVD

MEDIUM LOW

CVSS changed

Apr 28, 2026 - 19:52 NVD

5.4 (MEDIUM) 2.3 (LOW)

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26124

Patch released

Apr 28, 2026 - 19:30 nvd

Patch available

CVE Published

Apr 28, 2026 - 18:10 nvd

LOW 2.3

DescriptionCVE.org

OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation. Attackers can maintain unauthorized access to WebSocket connections after token rotation by exploiting the failure to disconnect existing shared-token sessions.

AnalysisAI

OpenClaw, an npm-distributed local AI assistant, fails to terminate existing WebSocket sessions when the shared gateway token is rotated, allowing a party who previously obtained a shared token to maintain persistent WebSocket access even after that token has been revoked through rotation. All releases prior to 2026.4.8 are affected. The CVSS 4.0 score of 2.3 with AT:P reflects specific conditions required - a pre-existing authenticated session plus a concurrent rotation event - and no public exploit code exists; CISA SSVC classifies exploitation status as none, consistent with the 0.03% EPSS score.

Technical ContextAI

OpenClaw (npm package identifier: openclaw) is a user-controlled local AI assistant. The vulnerability stems from CWE-613 (Insufficient Session Expiration): the session invalidation logic triggered by shared gateway token rotation does not walk and terminate existing WebSocket connections established under the old token. WebSocket connections are long-lived by design and do not re-authenticate on each message, so unless the server explicitly closes them on credential change, they remain open indefinitely. CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* covers all versions; the vendor advisory GHSA-5h3f-885m-v22w narrows the confirmed vulnerable range to npm/openclaw <= 2026.4.1. The trust model is explicitly user-controlled and single-tenant - the advisory states it does not assume a multi-tenant service boundary, which materially constrains the attack surface.

RemediationAI

Upgrade the openclaw npm package to version 2026.4.8, which is the vendor-confirmed patched release, verified by the maintainers with targeted regression tests before publication. The upstream fix commit is d7c3210cd6f5fdfdc1beff4c9541673e814354d5 (https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5). If an immediate upgrade is not possible, operators can mitigate by restarting the OpenClaw process after each token rotation, which forces all existing WebSocket sessions to close and re-authenticate against the new token; the trade-off is a brief service interruption for active connections. See the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-5h3f-885m-v22w for full details.