Openclaw cli: OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation (CVE-2026-43585)
Description
OpenClaw CLI versions prior to 2026.4.15 have a vulnerability where the gateway HTTP and WebSocket handlers cache bearer token authentication at startup. After a SecretRef rotation intended to revoke old tokens, the gateway could continue accepting the old bearer token until the process is restarted. This allows an old token to remain valid longer than intended, posing a high security risk. The issue is fixed in version 2026.4.15 by re-resolving bearer authentication from the current runtime secret snapshot on each request and WebSocket upgrade.
CVSS v3.1
Score 8.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenClaw CLI's gateway HTTP and WebSocket handlers previously captured bearer-auth configuration only once at server startup. When a SecretRef rotation occurred to revoke old bearer tokens, the running gateway continued to accept the old tokens because it did not re-resolve the authentication configuration dynamically. This vulnerability allows bearer tokens that should have been invalidated to remain valid for the lifetime of the gateway process. The fix in version 2026.4.15 ensures that the gateway re-resolves bearer authentication from the current runtime secret snapshot on every HTTP request and WebSocket upgrade, preventing acceptance of stale tokens.
Potential Impact
Bearer tokens that operators intended to revoke by rotating the SecretRef could remain valid on the gateway HTTP and WebSocket upgrade endpoints until the gateway process is restarted. This could allow unauthorized access using old tokens, maintaining confidentiality, integrity, and availability risks at a high severity level.
Mitigation Recommendations
A patch is available in OpenClaw CLI version 2026.4.15 that addresses this issue by dynamically resolving bearer authentication per request and upgrade. Users should upgrade to version 2026.4.15 or later to ensure that bearer tokens are properly invalidated after SecretRef rotation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-43585
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac2459212601ec6a3164968
Added to database: 10/04/2026, 12:24:50 UTC
Last enriched: 10/04/2026, 12:40:38 UTC
Last updated: 10/04/2026, 16:08:38 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.