CVE-2026-53830
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile — higher than 11% of all known CVEs
Summary
OpenClaw before version 2026.4.22 contains a webhook secret revocation bypass vulnerability, allowing old Slack and Zalo webhook secrets to remain active after secrets.reload. Attackers can exploit the stale-secret window to deliver webhook events after operator-expected secret revocation.
Risk Assessment
This vulnerability may lead to unauthorized access to the system, allowing attackers to use stale credentials to send webhook events.
Recommendation
It is recommended to update OpenClaw to version 2026.4.22 or later to mitigate this vulnerability and to regularly review and update webhook secrets.
Original NVD description (English source)
OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and Zalo webhook secrets to remain active after secrets.reload. Attackers can exploit the stale-secret window to deliver webhook events after operator-expected secret revocation, potentially accepting previous credentials.