Cyber Resilience

CVE-2026-45005

Openclaw ≤ 2026.4.23

Public PoC
Published
11 May 2026
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v4 5.9
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0029 21th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-45005 is a medium-severity Operation on a Resource after Expiration or Release (CWE-672) vulnerability in Openclaw Openclaw. Its CVSS base score is 5.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

OpenClaw before 2026.4.23 caches resolved webhook route secrets backed by SecretRef values, allowing stale secrets to remain valid after rotation and reload. Attackers with previously valid webhook route secrets can continue authenticating requests and invoking configured webhook task flows until…

more

gateway or plugin restart.

CWE(s)
CWE-672

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
Why these techniques?

Caching of stale webhook secrets directly enables prolonged use of previously valid credentials/secrets for authentication and task invocation after intended rotation/revocation.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-43585Same product: Openclaw Openclaw
CVE-2026-41356Same product: Openclaw Openclaw
CVE-2026-41348Same product: Openclaw Openclaw
CVE-2026-41340Same product: Openclaw Openclaw
CVE-2026-34503Same product: Openclaw Openclaw
CVE-2026-28477Same product: Openclaw Openclaw
CVE-2026-32034Same product: Openclaw Openclaw
CVE-2026-53843Same product: Openclaw Openclaw
CVE-2026-59261Same product: Openclaw Openclaw
CVE-2026-32001Same product: Openclaw Openclaw

Affected Assets

openclaw
openclaw
≤ 2026.4.23

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • IA-5 Authenticator Management
  • SC-12 Cryptographic Key Establishment and Management
  • AC-3 Access Enforcement
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

IA-5 Authenticator Management good match
prevent

Directly requires management of authenticator/secret lifecycle including rotation and immediate invalidation of prior values, preventing cached stale webhook secrets from remaining usable.

SC-12 Cryptographic Key Establishment and Management good match
prevent

Mandates proper cryptographic key and secret establishment plus rotation procedures so that resolved SecretRef values cannot be retained and used after rotation.

AC-3 Access Enforcement partial match
prevent

Enforces access decisions against current, authoritative credentials rather than cached prior values, blocking continued use of rotated webhook route secrets.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Enforcing managed authorizations and revocations directly prevents post-release operations on credentials or entitlements.

PR.PS-06 mostly match
prevents

Secure development practices eliminate the root coding flaw that permits use-after-release.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing can detect use-after-release but does not prevent it at runtime.

A.8.10 Information deletion partial match
degrades

Enforces timely deletion of resources so they cannot be used after release.

A.8.28 Secure coding partial match
prevents

Secure-coding rules require checks that prevent operations on freed or expired objects.

A.8.32 Change management partial match
prevents

Change-management processes can introduce or remove resource-lifetime controls.

References