OpenClaw versions prior to 2026.4.22 have a vulnerability where Slack and Zalo webhook secrets may remain active after a secrets.reload operation. This allows a caller with an old webhook secret to continue sending webhook events during a brief stale-secret window after secret rotation. The vulnerability affects the webhook secret revocation process but does not alter OpenClaw's trusted-operator security model. The impact depends on the operator's configuration and exposure of the affected feature. A fix is available starting with version 2026.4.22.