Medium severity6.0NVD Advisory· Published May 11, 2026· Updated May 13, 2026

CVE-2026-45005

Description

OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload. Attackers with previously valid webhook route secrets can continue authenticating requests and invoking configured webhook task flows until gateway or plugin restart.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
openclawnpm	< 2026.4.23	2026.4.23

Affected products

OpenClaw/Openclawreferences3 versions
(expand)+ 2 more
- (no CPE)
- cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.4.23
- (no CPE)range: <2026.4.23

Patches

Vulnerability mechanics

References

github.com/openclaw/openclaw/commit/36c4a372a0ad5dca8bfc0d93f7aab9c2f2de66fanvdPatchWEB
github.com/advisories/GHSA-q8ff-7ffm-m3r9ghsaADVISORY
github.com/openclaw/openclaw/security/advisories/GHSA-q8ff-7ffm-m3r9nvdThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2026-45005ghsaADVISORY
www.vulncheck.com/advisories/openclaw-webhook-route-secret-cache-not-invalidated-after-rotationnvdThird Party AdvisoryPatchWEB

News mentions

No linked articles in our index yet.

cvss	0.390
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000