CVE-2026-45002

Katalog CVE

CVSS 5.3 · Medium EPSS 0,48%

Kerentanan Incorrect Authorization pada openclaw. Skor CVSS 3.1 5.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.4.20 contains a hook session-key bypass vulnerability that allows attackers to circumvent the hooks.allowRequestSessionKey opt-in restriction. Attackers can render externally influenced session keys through templated hook mappings to bypass webhook routing isolation controls.

Rincian

Terbit di NVD

11 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/commit/5275d008ed33203dba3f98e969ad683a65c416c3 patch
• https://www.vulncheck.com/advisories/openclaw-hook-session-key-bypass-via-template-mapping patch · advisory pihak ketiga
• https://github.com/openclaw/openclaw/security/advisories/GHSA-2xcp-x87w-q377 advisory pihak ketiga