Timing Attack Vulnerability in OpenClaw: Potential Exposure of Hook Tokens
Summary
GHSA-47q7-97xp-m272: OpenClaw: Config writes could persist resolved ${VAR} secrets to disk. Affects openclaw versions < 2026.2.13. Fixed in 2026.2.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source library designed for managing webhooks in applications. It allows developers to easily set up and handle incoming webhook requests from various services. The library is built on npm and is widely used for its simplicity and effectiveness in integrating third-party services. However, a recent vulnerability has been identified that could expose sensitive hook tokens due to improper string comparison methods.
Vulnerability Detail
The vulnerability arises from OpenClaw's use of a non-constant-time string comparison for validating hook tokens. This flaw allows an attacker with network access to the hooks endpoint to exploit timing discrepancies across multiple requests. By measuring the response times, the attacker could gradually infer the correct hook token, potentially leading to unauthorized access to sensitive operations. This vulnerability is particularly concerning when hooks are exposed to untrusted networks, as it could allow attackers to manipulate or intercept webhook communications.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.13
This is the first release that contains the fix.
npm install openclaw@2026.2.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, users can restrict network access to the hooks endpoint and rotate the hook tokens after applying the update. This can be done by modifying firewall rules or using network security groups to limit access to trusted IP addresses only.
Conclusion
In summary, the timing attack vulnerability in OpenClaw poses a significant risk to applications using this library for webhook management. Users are strongly advised to upgrade to the patched version to ensure the security of their hook tokens. For those unable to upgrade immediately, implementing network restrictions and token rotation can serve as temporary mitigations.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability is a timing attack that allows attackers to infer hook tokens through response time analysis.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 6.9, indicating a moderate level of risk.
If you cannot upgrade, restrict access to the hooks endpoint and rotate your hook tokens to minimize risk.
The vulnerability was reported by a user identified as @akhmittra.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.