Horizon Alert
Summary of the vulnerability and why it matters
This issue in OpenClaw allows revoked access tokens to remain valid after configuration changes, potentially granting unauthorized access to gateway services. Teams should pay attention because this could let attackers bypass authentication controls and access sensitive resources.
- Unauthorized gateway access is possible.
- Affected systems are likely internet-facing.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this by using a previously valid bearer token that has since been revoked. This allows them to bypass authentication and gain unauthorized access to the OpenClaw gateway, impacting both HTTP and WebSocket connections. The vulnerability lies in how the gateway re-validates tokens only at startup, not on each request.
- No authentication is needed.
- Attacker needs a rotated-out token.
- Vulnerable: gateway handlers.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows revoked bearer tokens to remain valid after secret rotation, granting unauthorized gateway access. Attackers are likely to target this because it enables them to bypass authentication and access sensitive resources without needing to exploit other vulnerabilities. The impact is significant due to the direct pathway to unauthorized data or system control.
- Exploitable via network.
- No exploit code publicly available.
- Recent advisory published.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching or upgrading OpenClaw to version 2026.4.15 or later to fix the bearer token validation vulnerability. If immediate patching is not feasible, implement strict network segmentation and enhanced monitoring for any unauthorized access attempts on your gateways.
- Upgrade OpenClaw to 2026.4.15.
- Monitor gateway logs for anomalous traffic.
- Consider temporary service isolation.
