Bearer Token Validation Bypass in OpenClaw API by OpenClaw
CVE-2026-43585

9.2CRITICAL

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
6 May 2026

What is CVE-2026-43585?

Prior to version 2026.4.15, OpenClaw does not properly handle bearer token authentication post-SecretRef rotation. This oversight allows attackers to exploit revoked tokens that have not been invalidated correctly at the gateway, leading to unauthorized access. The system captures and retains the obsolete bearer-auth configuration during startup, resulting in a security weakness that can be leveraged for unauthorized actions via HTTP and WebSocket handlers.

Affected Version(s)

OpenClaw 0 < 2026.4.15

OpenClaw 2026.4.15

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://github.com/openclaw/openclaw/commit/acd4e0a32f12e...
patch
https://www.vulncheck.com/advisories/openclaw-bearer-toke...
third-party-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zsx (@zsxsoft)
KeenSecurityLab
qclawer
.