Executive brief
OpenClaw is an automation platform that uses webhooks to trigger task flows. A security flaw in how it handles authentication secrets means that even after an administrator changes a password or security key, the old one may remain active. This allows a person who previously had access to continue triggering automated tasks and potentially interfering with business operations until the system is fully restarted.
Technical details
OpenClaw before version 2026.4.23 caches resolved webhook route secrets backed by SecretRef values. When an operator rotates a secret and performs a reload, the system fails to invalidate the existing cache, leading to an 'Operation on a Resource after Expiration or Release' (CWE-672) condition. An attacker possessing a previously valid secret can continue to authenticate requests and invoke webhook task flows. The vulnerability persists until the gateway or plugin is manually restarted. The fix, introduced in version 2026.4.23, ensures that SecretRef-backed secrets are resolved on each request.
Affected products
- OpenClaw openclaw < 2026.4.23
Timeline
- 2026-04-24: advisory: Original advisory GHSA-q8ff-7ffm-m3r9 published
- 2026-05-11: disclosed: CVE-2026-45005 published
- 2026-05-11: advisory: Duplicate advisory GHSA-v8j2-5f9p-fmh4 published
- 2026-05-18: other: Duplicate advisory GHSA-v8j2-5f9p-fmh4 withdrawn