Openclaw cli: OpenClaw: Config writes could persist resolved ${VAR} secrets to disk (CVE-2026-28475)

OpenClaw CLI's hook token comparison was implemented using a regular string comparison instead of a constant-time comparison. This timing side-channel vulnerability allows an attacker with network access to the hooks endpoint to perform timing measurements over multiple requests to gradually infer the secret hook token. Exploitation requires the hooks endpoint to be exposed to an untrusted network and a large number of requests, with real-world network conditions potentially limiting reliability. The issue affects openclaw versions >=2026.1.29 and <2026.2.13 and is fixed in version 2026.2.12.

An attacker able to send numerous requests to the hooks endpoint could use timing measurements to infer the secret hook token, potentially allowing unauthorized access to hook functionality. The impact is limited by the need for network access to the hooks endpoint and the difficulty of reliable timing measurements in real-world conditions. The CVSS score is 4.8 (medium severity), reflecting limited confidentiality and integrity impact without privilege or user interaction requirements.

Upgrade openclaw to version 2026.2.12 or later, which includes a fix using constant-time token comparison. If immediate upgrade is not possible, restrict network access to the hooks endpoint to trusted sources and rotate the hook token after applying the update.