Openclaw cli: OpenClaw has non-constant-time token comparison in hooks authentication (CVE-2026-28464)

OpenClaw CLI's hooks authentication previously used a regular string comparison for the hook token, which is not constant-time. This allows an attacker with network access to the hooks endpoint to perform timing attacks by measuring differences in response times across multiple requests to gradually deduce the token. The vulnerability affects openclaw versions from 2026.1.29 up to but not including 2026.2.12. The issue is resolved in version 2026.2.12 by implementing a constant-time token comparison.

An attacker with network access to the hooks endpoint could potentially recover the authentication token by exploiting timing differences in token comparison. This could lead to unauthorized access to hooks functionality. However, exploitation requires the hooks endpoint to be exposed to an untrusted network and a large number of requests, with real-world network conditions potentially limiting attack reliability. The vulnerability does not impact confidentiality, integrity, or availability beyond token disclosure.

Upgrade openclaw to version 2026.2.12 or later where the vulnerability is fixed. If immediate upgrade is not possible, restrict network access to the hooks endpoint to trusted sources only and rotate the hooks token after upgrading to mitigate risk.