PT-2026-37319 · Npm · Openclaw

Published 2026-04-25 · Updated 2026-04-25

OSV

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages / Versions

• Package: openclaw (npm)
• Affected versions: < 2026.4.20
• Patched version: 2026.4.20

Impact

Templated hook mapping sessionKey values were treated differently from request-supplied session keys. A hook mapping could render an externally influenced session key even when hooks.allowRequestSessionKey was disabled, bypassing the intended routing opt-in for hook callers.

This affects webhook routing isolation. It does not grant host execution by itself. Severity is medium.

Fix

Template-rendered mapping session keys are now treated as externally supplied routing input and require hooks.allowRequestSessionKey=true plus the existing prefix policy checks.

Fix commit:

• 5275d008ed33203dba3f98e969ad683a65c416c3

Release

Fixed in OpenClaw 2026.4.20.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

GHSA-2XCP-X87W-Q377

Affected Products

Openclaw

References · 6

• https://osv.dev/vulnerability/GHSA-2xcp-x87w-q377 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45002 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-2xcp-x87w-q377 · Note
• https://github.com/openclaw/openclaw/commit/5275d008ed33203dba3f98e969ad683a65c416c3 · Note
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-hook-session-key-bypass-via-template-mapping · Note