CVE-2026-28464 Details

A timing attack vulnerability has been identified in OpenClaw versions prior to 2026.2.12. The issue arises from non-constant-time string comparisons used for validating hook tokens, which can be exploited by remote attackers with network access to the hooks endpoint. By measuring response times across multiple requests, an attacker could gradually infer the authentication token. This vulnerability requires hooks to be exposed to an untrusted network and a significant number of requests to be effective, as real-world network conditions can introduce variability that complicates precise timing measurements.

Users are advised to upgrade to OpenClaw version 2026.2.12 or later. If an immediate upgrade is not possible, restrict network access to the hooks endpoint and rotate the hooks token after updating.