CVE-2026-45005
OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload. Attackers with previously valid webhook route secrets can continue authenticating requests and invoking configured webhook task flows until gateway or plugin restart.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
- EPSS probability
- 0.29%
- CWE
- CWE-672
- Published
- 2026-05-11
- Last modified
- 2026-05-12
Affected products
- OpenClaw OpenClaw
- OpenClaw OpenClaw
Weakness type
Related vulnerabilities
- CVE-2026-53637 — Sylius: Cart FormComponent allows modification or deletion of an already-completed order
- CVE-2026-55250 — Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches
- CVE-2026-61699 — nebula-mesh: Certificate revocation is never enforced at the mesh
- CVE-2026-85044 — Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a...
- CVE-2026-19538 — Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS
- CVE-2026-79010 — Operation on a resource after expiration or release in Network in Google Chrome prior to...
- CVE-2026-44725 — EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution
- CVE-2026-52733 — ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip