CVE-2026-45002CWE-863

OpenClaw < 2026.4.20 - Hook Session-Key Bypass via Template Mapping

Medium · published May 11, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.20 contains a hook session-key bypass vulnerability that allows attackers to circumvent the hooks.allowRequestSessionKey opt-in restriction. Attackers can render externally influenced session keys through templated hook mappings to bypass webhook routing isolation controls.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00475 · 40.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-05-11T16:46Z
EPSS history
Timeline
  • 11 MAY 16:46Z
    OpenClaw < 2026.4.20 - Hook Session-Key Bypass via Template Mapping
    cvelistv5