Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-28464: OpenClaw before 2026.2.12 lets attackers guess auth token

CVE-2026-28464 · published 8 months ago

Summary

OpenClaw versions earlier than 2026.2.12 check hook tokens in a way that reveals small timing differences. An attacker who can reach the hook endpoint could use those differences to figure out the secret token and gain unauthorized access. Upgrade OpenClaw to version 2026.2.12 or later to fix the issue.

What to do

Update steipete openclaw to version 2026.2.12.
Update openclaw openclaw to version 2026.2.12 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	steipete	openclaw	< 2026.2.12 Fix: upgrade to 2026.2.12
–	openclaw	openclaw	< 2026.2.12 `cpe:2.3:a:openclaw:openclaw::::::node.js::*`

Original advisory text

OpenClaw < 2026.2.12 - Timing Attack in Hooks Token Authentication

OpenClaw versions prior to 2026.2.12 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements. Remote attackers with network access to the hooks endpoint can exploit timing side-channels across multiple requests to gradually determine the authentication token.

References

https://github.com/advisories/GHSA-jmm5-fvh5-gf4p
https://nvd.nist.gov/vuln/detail/CVE-2026-28464 Vendor Advisory
https://github.com/openclaw/openclaw/security/advisories/GHSA-jmm5-fvh5-gf4p Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-timing-attack-in-hooks-token-authe... Vendor Advisory
https://github.com/openclaw/openclaw/commit/113ebfd6a23c4beb8a575d48f74825932545... Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28464... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-208Observable Timing Discrepancy

Timeline

Published5 Mar 2026

Updated4 Nov 2026

First seen6 Mar 2026

Sources

CVE-2026-28464 · NVD

GHSA-jmm5-fvh5-gf4p · GHSA

CVE-2026-28464 · OSV

Track software like this

Free during beta