Openclaw cli: OpenClaw: Hook mapping templates could bypass hook session-key opt-in (CVE-2026-45002)
Description
OpenClaw CLI versions before 2026.4.20 have a vulnerability where hook mapping templates could bypass the intended session-key opt-in control. This flaw allows a hook mapping to produce an externally influenced session key even when the configuration to disallow request session keys is enabled. The issue affects webhook routing isolation but does not enable host execution by itself. The vulnerability is fixed in version 2026.4.20.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In OpenClaw CLI versions prior to 2026.4.20, templated hook mapping sessionKey values were treated differently from request-supplied session keys. This discrepancy allowed a hook mapping to render an externally influenced session key despite the 'hooks.allowRequestSessionKey' setting being disabled, effectively bypassing the routing opt-in control for hook callers. The vulnerability impacts webhook routing isolation but does not grant host execution capabilities. The fix, introduced in version 2026.4.20, ensures that template-rendered mapping session keys are treated as externally supplied routing input and thus require 'hooks.allowRequestSessionKey=true' along with existing prefix policy checks.
Potential Impact
The vulnerability compromises webhook routing isolation by allowing externally influenced session keys to be used even when the configuration disallows it. This could lead to unintended routing behavior of hooks. However, it does not provide an attacker with host execution privileges or direct code execution capabilities. The severity is assessed as medium.
Mitigation Recommendations
A patch is available in OpenClaw CLI version 2026.4.20 that addresses this issue. Users should upgrade to version 2026.4.20 or later. The fix ensures that template-rendered session keys require the same opt-in and policy checks as request-supplied session keys, preventing bypass of the routing isolation controls.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-45002
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 4.0
Threat ID: 6ac245d312601ec6a3168019
Added to database: 10/04/2026, 12:25:55 UTC
Last enriched: 10/04/2026, 13:17:25 UTC
Last updated: 10/04/2026, 16:08:38 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.