CVE-2026-43585
OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef rotation. Gateway HTTP and WebSocket handlers fail to re-resolve authentication per-request, enabling attackers to use rotated-out bearer tokens for unauthorized gateway access.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.2
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.54%
- CWE
- CWE-672
- Published
- 2026-05-06
- Last modified
- 2026-05-07
Affected products
- OpenClaw OpenClaw
- OpenClaw OpenClaw
Weakness type
Related vulnerabilities
- CVE-2026-53637 — Sylius: Cart FormComponent allows modification or deletion of an already-completed order
- CVE-2026-55250 — Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches
- CVE-2026-61699 — nebula-mesh: Certificate revocation is never enforced at the mesh
- CVE-2026-85044 — Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a...
- CVE-2026-19538 — Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS
- CVE-2026-79010 — Operation on a resource after expiration or release in Network in Google Chrome prior to...
- CVE-2026-44725 — EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution
- CVE-2026-52733 — ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip