PT-2026-39691 · Openclaw · Openclaw

Keensecuritylab + 1 · Published 2026-04-25 · Updated 2026-05-11 · CVE-2026-45002

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.20

Description A hook session-key bypass allows attackers to circumvent the hooks.allowRequestSessionKey opt-in restriction. By using templated hook mappings, attackers can render externally influenced session keys to bypass webhook routing isolation controls.

Recommendations Update to version 2026.4.20 or later.

Exploit

Fix

IDOR

Incorrect Authorization

Weakness Enumeration

CWE-639

CWE-863

Related Identifiers

CVE-2026-45002

GHSA-2XCP-X87W-Q377

GHSA-9J32-3M66-MC4M

Affected Products

Openclaw

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45002.json · Exploit
• https://github.com/openclaw/openclaw/commit/5275d008ed33203dba3f98e969ad683a65c416c3 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-2xcp-x87w-q377 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-45002 · Vendor Advisory
• https://vulncheck.com/advisories/openclaw-hook-session-key-bypass-via-template-mapping · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-45002 · Security Note
• https://osv.dev/vulnerability/GHSA-2xcp-x87w-q377 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9j32-3m66-mc4m · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://t.me/CVEtracker/53388 · Telegram Post
• https://twitter.com/CVEnew/status/2053932432169345354 · Twitter Post