CVE-2026-45002: OpenClaw: Hook mapping templates could bypass hook session-key opt-in
(updated )
Templated hook mapping sessionKey values were treated differently from request-supplied session keys. A hook mapping could render an externally influenced session key even when hooks.allowRequestSessionKey was disabled, bypassing the intended routing opt-in for hook callers.
This affects webhook routing isolation. It does not grant host execution by itself. Severity is medium.
References
- github.com/advisories/GHSA-2xcp-x87w-q377
- github.com/openclaw/openclaw/commit/5275d008ed33203dba3f98e969ad683a65c416c3
- github.com/openclaw/openclaw/security/advisories/GHSA-2xcp-x87w-q377
- nvd.nist.gov/vuln/detail/CVE-2026-45002
- www.vulncheck.com/advisories/openclaw-hook-session-key-bypass-via-template-mapping
Code Behaviors & Features
Detect and mitigate CVE-2026-45002 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →