OpenClaw before 2026.4.22 contains a flaw that lets attackers keep using old Slack and Zalo webhook secrets even after the system performs a secrets.reload, which is intended to revoke previously issued credentials. The vulnerability enables malicious actors to deliver webhook events during the brief window when the stale secrets are still accepted, effectively allowing them to bypass the operator‑expected revocation and potentially gain unauthorized access to the system.

OpenClaw (OpenClaw) versions older than 2026.4.22 are affected.

This issue is rated with a CVSS score of 6, indicating moderate severity. The EPSS score is not available, meaning current data does not quantify likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely exploit it by sending webhook payloads from a Slack or Zalo integration that still carries a revoked secret. The likely attack vector is remote, with an adversary needing only to produce a valid webhook event to bypass the revocation logic – a condition that can be met without any privileged account or system discovery.