CVE-2026-28464
Openclaw ≤ 2026.2.12
Raw vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-28464 is a high-severity Observable Timing Discrepancy (CWE-208) vulnerability in Openclaw Openclaw. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Password Guessing (T1110.001); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-28464 affects OpenClaw versions prior to 2026.2.12, where the software uses non-constant-time string comparison during hook token validation. This flaw, classified under CWE-208 (Observable Timing Discrepancy), enables attackers to infer authentication tokens through precise timing measurements. The vulnerability carries a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting network accessibility but high attack complexity, with a high impact on confidentiality.
Remote attackers with network access to the OpenClaw hooks endpoint can exploit this timing side-channel by sending multiple crafted requests and measuring response times. Over time, these measurements allow gradual determination of the authentication token, potentially granting unauthorized access to protected hooks functionality without requiring privileges or user interaction.
Mitigation involves upgrading to OpenClaw version 2026.2.12 or later, as indicated by the patch in commit 113ebfd6a23c4beb8a575d48f7482593254506ec. Additional details are available in the GitHub Security Advisory GHSA-jmm5-fvh5-gf4p and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-timing-attack-in-hooks-token-authentication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9910
Vulnerability Data
OpenClaw versions prior to 2026.2.12 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements. Remote attackers with network access to the hooks endpoint can exploit timing side-channels across multiple requests to gradually determine…
more
the authentication token.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V11.2.4
Mitigating Controls (NIST 800-53 r5) AI
Developer testing can include timing analysis or side-channel test cases that reveal observable timing discrepancies.
Engineering principles can mandate constant-time algorithms and side-channel resistance so timing discrepancies are never introduced.
Requiring approved cryptographic modules and algorithms implicitly demands implementations free of observable timing leaks.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require constant-time implementations that eliminate observable timing discrepancies.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Consistent reference clocks limit the attacker's ability to measure or manipulate timing differences that could reveal internal state or processing paths.