CVE-2026-45005

Katalog CVE

CVSS 6.0 · Medium EPSS 0,51%

Kerentanan Operation on a Resource after Expiration or Release pada openclaw. Skor CVSS 3.1 6.0 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload. Attackers with previously valid webhook route secrets can continue authenticating requests and invoking configured webhook task flows until gateway or plugin restart.

Rincian

Terbit di NVD

11 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.0 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-672: Operation on a Resource after Expiration or Release

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/commit/36c4a372a0ad5dca8bfc0d93f7aab9c2f2de66fa patch
• https://www.vulncheck.com/advisories/openclaw-webhook-route-secret-cache-not-invalidated-after-rotation patch · advisory pihak ketiga
• https://github.com/openclaw/openclaw/security/advisories/GHSA-q8ff-7ffm-m3r9 advisory pihak ketiga