Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef rotation. Gateway HTTP and WebSocket handlers fail to re-resolve authentication per-request, enabling attackers to use rotated-out bearer tokens for unauthorized gateway access.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-43585 OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef rotation. Gateway HTTP and W… https://www.cve.org/CVERecord?id=CVE-2026-43585
Post summary
The CVE-2026-43585 entry explains how OpenClaw can retain revoked tokens by capturing the bearer‑auth configuration early, without any PoC or exploit disclosed.
CVE-2026-43585 Bearer Token Validation Bypass in OpenClaw Before 2026.4.15 via SecretRef Rotation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-43585
Post summary
The snippet announces the discovery of CVE-2026-43585, detailing a bearer token validation bypass in OpenClaw related to SecretRef rotation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |