CVE-2026-45005

Published: Mag 11, 2026 Last Modified: Mag 11, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,9
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 6,0
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: high
Availability: low

Description

AI Translation Available

OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload. Attackers with previously valid webhook route secrets can continue authenticating requests and invoking configured webhook task flows until gateway or plugin restart.

672

Operation on a Resource after Expiration or Release

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Other Availability
Potential Impacts:
Modify Application Data Read Application Data Other Dos: Crash, Exit, Or Restart
Applicable Platforms
Technologies: Mobile
View CWE Details
https://github.com/openclaw/openclaw/commit/36c4a372a0ad5dc…
https://github.com/openclaw/openclaw/commit/36c4a372a0ad5dca8bfc0d93f7aab9c2f2d…
https://github.com/openclaw/openclaw/security/advisories/GH…
https://github.com/openclaw/openclaw/security/advisories/GHSA-q8ff-7ffm-m3r9
https://www.vulncheck.com/advisories/openclaw-webhook-route…
https://www.vulncheck.com/advisories/openclaw-webhook-route-secret-cache-not-in…