CVE-2026-43585 is a high severity authentication flaw (CVSS 8.1) in OpenClaw before version 2026.4.15. It captures bearer token settings at startup, so tokens rotated out through SecretRef stay valid on the gateway. Upgrade to 2026.4.15 or later and restart the service.
What's affected
The record says OpenClaw before 2026.4.15 is affected. The gateway HTTP and WebSocket handlers do not look up the authentication secret again on each request, so a change to the secret has no effect until restart.
The project advisory is GHSA-xmxx-7p24-h892, which I did not retrieve.
How to check if you're exposed
Find the version of OpenClaw you run and compare it with the fixed version above. If you installed it with npm, this works:
npm ls -g openclaw
Otherwise use the version your installer, container tag or deployment record shows. Then list the gateways, channels and webhooks that are exposed to people or systems you do not control, since these issues concern how untrusted input is handled.
Also ask whether you have rotated gateway tokens since you started the process. If you did, old tokens may still be accepted by a running instance.
What to do now
- Upgrade OpenClaw to 2026.4.15 or later.
- Restart the gateway after any token rotation until you are on the fixed version.
- Rotate gateway tokens again after the upgrade.
- Review gateway access logs for use of tokens you believed were revoked.
- Keep the gateway off the public internet where you can.
Why it matters
The weakness is CWE-672, operation on a resource after expiration or release. The secret was resolved once and kept in memory, so the revocation never reached the running code.
Rotation is meant to cut off a leaked credential. A service that ignores the new value gives a false sense of safety. The attack complexity is rated high, and the KEV flag is false.
Quick check
Does restarting help before I can upgrade?
Per the description, the stale value is captured at startup, so a restart should load the new one. Upgrade anyway.
Sources
- GitHub security advisory GHSA-xmxx-7p24-h892 (listed in the NVD record, not retrieved)
- VulnCheck advisory (listed in the NVD record, not retrieved)
- Gold page for this CVE
Last reviewed: 19 October 2026.
