Search: CVE-2026-53830

OpenClaw CLI versions from 2026.1.29 up to but not including 2026.4.22 have a vulnerability where Slack and Zalo webhook secrets may remain active after a secrets.reload operation. This allows a caller with an old webhook secret to continue sending webhook events during a brief stale-secret window after revocation. The issue affects only the named feature and does not alter the trusted-operator security model. The vulnerability has a medium severity rating with a CVSS score of 6.5. A patch is available starting from version 2026.4.22. Operators are advised to restart the affected channel runtime after rotating webhook secrets as a mitigation until they apply the patch.