OpenClaw versions prior to 2026.2.12 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements.
Date: 2026-03
Affected: openclaw/openclaw
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-25474
CVE-2026-26316
CVE-2026-26972
CVE-2026-28395
CVE-2026-28447
CVE-2026-28448
CVE-2026-28450
CVE-2026-28454
CVE-2026-28458
CVE-2026-28459
CVE-2026-28462
CVE-2026-28464
CVE-2026-28475
CVE-2026-28478
CVE-2026-28481
CVE-2026-28482
CVE-2026-29613
CWE: CWE-117
CWE-1327
CWE-201
CWE-208
CWE-22
CWE-285
CWE-306
CWE-330
CWE-345
CWE-639
CWE-73
CWE-770
CWE-863
CVSS: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

OpenClaw versions prior to 2026.2.12 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements. Remote attackers with network access to the hooks endpoint can exploit timing side-channels across multiple requests to gradually determine the authentication token.


Mitigations:

Architectural layers (MAESTRO):