Openclaw cli: OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload (CVE-2026-45005)

OpenClaw's webhook route secret caching mechanism caused previously valid SecretRef-backed secrets to remain effective after secret rotation and running 'openclaw secrets reload'. This caching meant that the old secret could still authenticate webhook requests until the plugin or gateway was restarted. The vulnerability affects openclaw CLI versions >=2026.1.29 and <2026.4.23. The fix, introduced in version 2026.4.23, changes the behavior to resolve SecretRef secrets on every request, ensuring that rotated secrets take effect immediately after reload without needing a restart.

An attacker with knowledge of a previously valid webhook route secret can continue to authenticate webhook requests even after the secret has been rotated and reloaded by the operator. This undermines the effectiveness of secret rotation, potentially allowing unauthorized invocation of webhook tasks until the plugin or gateway is restarted. The impact is limited by the requirement that the attacker must already possess a valid secret prior to rotation.

Upgrade to openclaw CLI version 2026.4.23 or later, where the webhook route secret resolution occurs on each request, invalidating old secrets immediately after rotation and reload. No additional action is required once updated, as the fix removes the need to restart the plugin or gateway to enforce secret changes.