CVE-2026-43585
HIGH
NVD
CVSS Score
8.1
Severity
HIGH
Published
May 06, 2026
Vendor
unknown
Description
OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef rotation. Gateway HTTP and WebSocket handlers fail to re-resolve authentication per-request, enabling attackers to use rotated-out bearer tokens for unauthorized gateway access.