CVE-2026-45005CWE-672

OpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After Rotation

Medium · published May 11, 2026

CVSS v4.0
5.9
EPSS
1%
Percentile
42.6
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload. Attackers with previously valid webhook route secrets can continue authenticating requests and invoking configured webhook task flows until gateway or plugin restart.

The record
Technical detail
CVSS v4.0
5.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00510 · 42.6th percentile
Weakness
CWE-672 · Operation on a Resource after Expiration or Release
Published
2026-05-11T16:46Z
EPSS history
Timeline
  • 11 MAY 16:46Z
    OpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After Rotation
    cvelistv5