vulnerability · openclaw
OpenClaw webhook rotation could leave a stale-secret window
Affected Slack and Zalo channel runtimes could accept an old webhook secret after secrets reload. Events could therefore be accepted briefly after an operator expected revocation.
medium severityhigh confidencepatchedNo known exploitation
Quick answer
What defenders need to know
- What is it?
- Affected Slack and Zalo channel runtimes could accept an old webhook secret after secrets reload. Events could therefore be accepted briefly after an operator expected revocation.
- Who is affected?
- openclaw <= 2026.4.21
- What should defenders do?
- Upgrade OpenClaw to 2026.4.22 or later.
- Is a fix available?
- Yes. Upgrade to 2026.4.22.
01 / Response
What to do
- Upgrade OpenClaw to 2026.4.22 or later.
- Until patched, restart the affected channel runtime after rotating webhook secrets. Restrict channel access and disable unused channels.
02 / Technical assessment
Evidence-backed analysis
Exposure requires the affected channel and knowledge of a previous secret. This concerns OpenClaw channel secret refresh, not a demonstrated compromise of Slack or Zalo. No observed exploitation is established by this source.
- Affected Slack and Zalo channel runtimes could accept an old webhook secret after secrets reload. Events could therefore be accepted briefly after an operator expected revocation.
03 / Timeline
Disclosure timeline
- GitHub Advisory Database publication
OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload
04 / Standards crosswalk
Standards crosswalk
No standards mappings are published for this record.
05 / Primary sources