PT-2026-23539 · Openclaw · Openclaw

Akhmittra

·

Published

2026-03-02

·

Updated

2026-03-13

·

CVE-2026-28464

CVSS v4.0

8.2

High

VectorAV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.12
Description The software uses non-constant-time string comparison for hook token validation. This allows attackers to potentially infer tokens through timing measurements. Remote attackers with network access to the hooks endpoint can exploit timing side-channels across multiple requests to gradually determine the authentication token. Real-world latency and jitter can make reliable measurement difficult. The issue involves comparing the provided hook token using a regular string comparison, which is not constant-time. The hooks endpoint is the relevant API endpoint. The vulnerable operation involves the validation of the hook token.
Recommendations Upgrade to OpenClaw version 2026.2.12 or later. If users cannot upgrade immediately, restrict network access to the hooks endpoint and rotate the hooks token after updating.

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2026-28464
GHSA-JMM5-FVH5-GF4P

Affected Products

Openclaw