Skip to main content

OpenClaw CVE-2026-45005

| EUVDEUVD-2026-29150 MEDIUM
Operation on a Resource after Expiration or Release (CWE-672)
2026-05-11 VulnCheck GHSA-v8j2-5f9p-fmh4
Information Disclosure Openclaw
5.9
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

4
CVSS changed
May 11, 2026 - 18:22 NVD
6.0 (MEDIUM) 5.9 (MEDIUM)
Source Code Evidence Fetched
May 11, 2026 - 17:48 vuln.today
Analysis Generated
May 11, 2026 - 17:48 vuln.today
CVE Published
May 11, 2026 - 16:46 nvd
MEDIUM 6.0

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.4.23.

DescriptionCVE.org

OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload. Attackers with previously valid webhook route secrets can continue authenticating requests and invoking configured webhook task flows until gateway or plugin restart.

AnalysisAI

OpenClaw before 2026.4.23 fails to invalidate cached webhook route secrets after rotation, allowing attackers with previously valid secrets to continue authenticating webhook requests and invoking task flows until gateway restart. The vulnerability affects SecretRef-backed webhook authentication where the resolved secret is cached at startup rather than re-resolved per request, weakening credential rotation effectiveness. Vendor-released patch available in version 2026.4.23.

Technical ContextAI

OpenClaw's webhooks extension implements SecretRef-based authentication for webhook routes, allowing operators to reference secrets stored in a configuration backend. The vulnerable code maintained a WeakMap cache (secretByTarget) that stored resolved secret promises at handler initialization time. When an operator rotated the underlying secret via openclaw secrets reload, the cached resolved value remained valid in memory until the gateway process restarted. The fix refactors resolveTargetSecret() to resolve SecretRef values on each request rather than caching them, ensuring that openclaw secrets reload immediately invalidates stale secrets. This addresses CWE-672 (Weakened Cryptography) by ensuring credential rotation is effective without requiring process restart.

RemediationAI

Vendor-released patch: upgrade OpenClaw to version 2026.4.23 or later. Apply commit 36c4a372a0ad5dca8bfc0d93f7aab9c2f2de66fa or pull the tagged release. After patching, webhook route secrets backed by SecretRef will be re-resolved on each request, eliminating the caching window. Operators who have rotated secrets in vulnerable versions should assume previously valid secrets remain active until gateway/plugin process restart - consider rotating webhook secrets again after upgrading to 2026.4.23 and restarting the gateway to ensure no stale credentials remain. No workarounds are available for pre-2026.4.23 versions; immediate upgrade is required to restore credential rotation security. See https://github.com/openclaw/openclaw/security/advisories/GHSA-q8ff-7ffm-m3r9 for advisory details.

More in Openclaw

View all
CVE-2026-28446 CRITICAL POC
9.4 Mar 05

Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
CVE-2026-33579 CRITICAL POC
9.4 Mar 31

Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
CVE-2026-32042 HIGH POC
8.8 Mar 21

OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
CVE-2026-32051 HIGH POC
8.8 Mar 21

An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
CVE-2026-25253 HIGH POC
8.8 Feb 01

OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
CVE-2026-32846 HIGH POC
8.7 Mar 26

Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
CVE-2026-32064 HIGH POC
7.7 Mar 21

OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
CVE-2026-32055 HIGH POC
7.6 Mar 21

OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
CVE-2026-32056 HIGH POC
7.5 Mar 21

OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
CVE-2026-32049 HIGH POC
7.5 Mar 21

OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
CVE-2026-32048 HIGH POC
7.5 Mar 21

OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low

CVE-2026-25474 HIGH POC
7.5 Feb 19

OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec

Same weakness CWE-672 – Operation on a Resource after Expiration or Release

View all
CVE-2020-11027 HIGH POC
8.1
CVE-2025-69415 HIGH POC
7.1
CVE-2019-20022 MEDIUM POC
6.5
CVE-2020-24030 CRITICAL
9.8
CVE-2020-12043 CRITICAL
9.8
CVE-2022-45292 MEDIUM POC
5.3
CVE-2026-43585 CRITICAL
9.2
CVE-2013-10075 CRITICAL
9.1

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2026-45005 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy