CVE-2026-45005

תיאור (מקור, אנגלית)

OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload. Attackers with previously valid webhook route secrets can continue authenticating requests and invoking configured webhook task flows until gateway or plugin restart.

מדדים

CVSS 3.1

6.0 (MEDIUM) מקור הציון: CNA CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

CVSS 4.0

5.9 (MEDIUM) מקור הציון: CNA CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-2/8/2026

CWE

CWE-672

מוצרים מושפעים

openclaw: openclaw

קישורים

• https://github.com/openclaw/openclaw/commit/36c4a372a0ad5dca8bfc0d93f7aab9c2f2‮… Patch
• https://www.vulncheck.com/advisories/openclaw-webhook-route-secret-cache-not-i‮… PatchThird Party Advisory
• https://github.com/openclaw/openclaw/security/advisories/GHSA-q8ff-7ffm-m3r9 Third Party Advisory