Executive brief
OpenClaw Gateway is a connectivity component used in IoT and device management systems. When administrator credentials are rotated via the `device.token.rotate` operation, existing WebSocket sessions authenticated with the old credentials remain active and can continue communicating with the gateway. This creates a window where a compromised or revoked credential can still be used by an attacker until those sessions are manually terminated.
Technical details
The vulnerability is a session-invalidation flaw (CWE-613) in the `device.token.rotate` function of OpenClaw Gateway version ≤2026.3.28. When device tokens are rotated, the implementation does not terminate active WebSocket sessions that were authenticated using the old token. An attacker with access to a revoked credential can maintain persistent communication with the gateway if an active WebSocket session exists. The attack requires prior network reachability and authentication (the old token), but once compromised, the attacker can indefinitely use the old credential until the session times out naturally. The fix was released in version 2026.3.31 (commit 91f7a6b) which properly disconnects WebSocket sessions upon token rotation.
Affected products
- OpenClaw Gateway <=2026.3.28
Timeline
- 2026-03-31: disclosed: Security advisory published
- 2026-03-31: patched: Fix committed (commit 91f7a6b)
- 2026-04-03: other: Advisory publicly available (GHSA-rfqg-qgf8-xr9x)