CVE-2026-45005: OpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After Rotation
OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload. Attackers with previously valid webhook route secrets can continue authenticating requests and invoking configured webhook task flows until gateway or plugin restart.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45005?
CVE-2026-45005 is considered to have a medium severity due to the risk of unauthorized access via stale webhook route secrets.
How do I fix CVE-2026-45005?
To fix CVE-2026-45005, upgrade to OpenClaw version 2026.4.23 or later to ensure the webhook route secret cache is invalidated after rotation.
What are the potential impacts of CVE-2026-45005?
The potential impacts of CVE-2026-45005 include unauthorized access to webhook functionalities by using previously valid secrets.
What systems are affected by CVE-2026-45005?
CVE-2026-45005 affects all versions of OpenClaw prior to 2026.4.23 that utilize cached webhook route secrets.
How does CVE-2026-45005 allow attackers to exploit the system?
CVE-2026-45005 allows attackers to exploit the system by leveraging previously valid webhook route secrets that are not invalidated after rotation.