Openclaw cli: OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation (CVE-2026-41356)

CVE-2026-41356 describes a vulnerability in the OpenClaw CLI package where the gateway command `device.token.rotate` fails to disconnect active WebSocket sessions after device tokens are rotated. This means that even after credentials are rotated, existing authenticated WebSocket sessions remain active, which can be exploited as a post-compromise revocation gap. The vulnerability affects versions >=2026.1.29 and <2026.3.31. The issue was fixed in version 2026.3.31 by commit 91f7a6b0fd67b703897e6e307762d471ca09333d.

An attacker or compromised entity could maintain active WebSocket sessions even after device tokens have been rotated, potentially allowing continued access despite credential revocation. The impact is limited to a post-compromise scenario and does not directly allow initial unauthorized access. The CVSS score of 5.4 reflects a medium severity with low confidentiality and integrity impact and no availability impact.

Users should upgrade to OpenClaw CLI version 2026.3.31 or later, where the issue has been fixed. The fix ensures that active WebSocket sessions are terminated upon device token rotation, closing the post-compromise revocation gap. No additional mitigation is required beyond applying the official patch.