PT-2026-39694 · Openclaw · Openclaw

Feynman-Hou · Published 2026-05-05 · Updated 2026-05-11 · CVE-2026-45005

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.23

Description The software caches resolved webhook route secrets backed by SecretRef values. This behavior allows stale secrets to remain valid even after they have been rotated and reloaded. Consequently, an attacker possessing previously valid webhook route secrets can continue to authenticate requests and invoke configured webhook task flows until the gateway or plugin is restarted.

Recommendations Update to version 2026.4.23 or later. As a temporary workaround, restart the gateway or plugin to clear the cached secrets.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

CWE-672

Related Identifiers

CVE-2026-45005

GHSA-Q8FF-7FFM-M3R9

GHSA-V8J2-5F9P-FMH4

Affected Products

Openclaw

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45005.json · Exploit
• https://github.com/openclaw/openclaw/commit/36c4a372a0ad5dca8bfc0d93f7aab9c2f2de66fa · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-q8ff-7ffm-m3r9 · Vendor Advisory
• https://vulncheck.com/advisories/openclaw-webhook-route-secret-cache-not-invalidated-after-rotation · Patch
• https://osv.dev/vulnerability/CVE-2026-45005 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v8j2-5f9p-fmh4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45005 · Security Note
• https://osv.dev/vulnerability/GHSA-q8ff-7ffm-m3r9 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://t.me/CVEtracker/53391 · Telegram Post
• https://twitter.com/CVEnew/status/2053932429166186546 · Twitter Post