Executive brief
OpenClaw, a gateway for managing webhooks, contains a flaw where Slack and Zalo security secrets remain active even after an administrator attempts to rotate or revoke them. This means that an unauthorized party possessing an old secret could continue to send webhook events to the system for a short period after they should have been blocked. This could lead to unauthorized data being processed or actions being triggered by revoked credentials.
Technical details
A vulnerability in OpenClaw's secret management logic (CWE-613) causes Slack and Zalo webhook secrets to persist in an active state after a `secrets.reload` command is issued. The root cause is a 'stale-secret window' where the runtime fails to immediately invalidate the previous secret upon rotation. A network-based attacker possessing a revoked secret can continue to successfully authenticate webhook events during this window. The issue is fixed in version 2026.4.22; users on older versions should restart the affected channel runtime after rotating secrets to ensure immediate revocation.
Affected products
- OpenClaw openclaw <= 2026.4.21
Timeline
- 2026-05-28: disclosed
- 2026-07-02: advisory
- 2026-04-22: patched: First stable patched version released.