CVE-2026-28464: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-28464 is a timing side-channel vulnerability in OpenClaw (npm package) affecting all versions prior to 2026.2.12. The flaw involves the use of non-constant-time string comparison for hook token validation, enabling remote attackers to infer authentication tokens through timing measurements across many requests. It was published on March 5, 2026, and assigned by VulnCheck. The CVSS v3.1 base score is 7.5 (High), while the CVSS v4.0 base score is 8.2 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-208 (Observable Timing Discrepancy): the hooks authentication code compared the provided token against the expected token using a standard JavaScript string equality operator (!==), which short-circuits on the first mismatched character and thus leaks timing information (GitHub Advisory). An attacker with network access to the hooks endpoint can send a large volume of crafted HTTP requests with varying token guesses, measuring response times to incrementally determine correct token characters — a classic timing oracle attack (CAPEC-462: Cross-Domain Search Timing) (Feedly). The fix introduced a dedicated safeEqualSecret() function using Node.js's timingSafeEqual from node:crypto, applied consistently across hook token and device token validation (GitHub Commit). No authentication or special privileges are required to reach the vulnerable endpoint, though exploitation requires the hooks endpoint to be exposed to an untrusted network and a large number of requests; real-world network jitter can complicate reliable measurement (GitHub Advisory).

Successful exploitation allows a remote, unauthenticated attacker to recover the hook authentication token, enabling them to forge authenticated webhook requests to the OpenClaw hooks endpoint. This could lead to unauthorized modifications to system state, data manipulation, and unauthorized access to sensitive operations such as triggering agent hooks or wake events (Feedly, GitHub Advisory). The confidentiality impact is high (token disclosure), while integrity and availability are not directly impacted by the timing attack itself, though subsequent forged requests could affect both (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.00165, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is theoretically feasible for any attacker with network access to the hooks endpoint but is practically constrained by the need for a large number of requests and the difficulty of making precise timing measurements over real-world networks (GitHub Advisory).

1. Reconnaissance: Identify OpenClaw instances with the hooks endpoint exposed to the network (e.g., via port scanning for the default gateway port 18789 or configured alternatives).
2. Baseline timing measurement: Send HTTP POST requests to the /hooks/wake or /hooks/agent endpoint with a known-wrong token and measure response times to establish a baseline for timing differences.
3. Token enumeration via timing oracle: Iteratively send requests with token guesses that vary one character at a time (e.g., brute-forcing character by character), measuring response latency for each guess. Because the non-constant-time comparison returns faster on early mismatches, slightly longer response times indicate a correct prefix.
4. Statistical analysis: Aggregate timing data across many requests (hundreds to thousands per character position) to overcome network jitter and identify statistically significant timing differences that reveal the correct token character.
5. Token reconstruction: Repeat the process for each character position until the full token is recovered.
6. Forge authenticated requests: Use the recovered token in the Authorization: Bearer <token> header to send authenticated webhook requests, triggering agent hooks, wake events, or other privileged operations (GitHub Advisory, GitHub Commit).

• Network: High volume of HTTP POST requests to /hooks/wake, /hooks/agent, or other /hooks/* endpoints from a single IP address or small IP range, especially with varying Authorization: Bearer header values.
• Logs: Repeated HTTP 401 responses logged for the hooks endpoint from the same client address; subsequent HTTP 429 (Too Many Requests) responses indicating the auth-failure rate limiter was triggered (patched versions only); eventual successful 200/202 responses following a pattern of failed attempts from the same source.
• Application Logs: Log entries such as hook auth throttled for <client_ip>; retry-after=<N>s in OpenClaw gateway logs (patched versions).
• Behavioral: Unusual or unexpected webhook-triggered actions (agent runs, wake events) not initiated by known legitimate sources, potentially indicating a successfully forged authenticated request (GitHub Advisory, GitHub Commit).

Upgrade OpenClaw (npm) to version 2026.2.12 or later, which replaces the vulnerable string comparison with a constant-time safeEqualSecret() function and adds per-client auth-failure rate limiting (HTTP 429 with Retry-After) (GitHub Advisory, GitHub Commit). If immediate upgrade is not possible, restrict network access to the hooks endpoint to loopback, a trusted Tailnet, or a trusted reverse proxy, and rotate the hooks token after updating. Using a dedicated, high-entropy hook token (not reused from gateway auth tokens) also reduces the practical risk of token recovery (GitHub Advisory).

The vulnerability was reported by researcher akhmittra and credited in the fix commit and advisory (GitHub Advisory). The advisory was published by steipete on February 15, 2026, and the fix was merged promptly. Brief mentions appeared on Mastodon (via @thehackerwire) and were tracked by VulnDB and CVEFeed shortly after disclosure (Feedly). No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified.