CVE-2026-45005: OpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After Rotation

Severity: medium (CVSS 6.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-11 · updated 2026-06-17
Weakness: CWE-672

Description

OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload. Attackers with previously valid webhook route secrets can continue authenticating requests and invoking configured webhook task flows until gateway or plugin restart.

Affected products

OpenClaw: before 2026.4.23 — fixed in 2026.4.23

How to fix

Upgrade to a fixed version: OpenClaw 2026.4.23. Check the vendor advisory for mitigations.

References

https://github.com/openclaw/openclaw/commit/36c4a372a0ad5dca8bfc0d93f7aab9c2f2de66fa
https://github.com/openclaw/openclaw/security/advisories/GHSA-q8ff-7ffm-m3r9
https://www.vulncheck.com/advisories/openclaw-webhook-route-secret-cache-not-invalidated-after-rotation

Get alerted when CVE-2026-45005 or the next vulnerability affects your stack