An operation on a resource after expiration or release vulnerability in OpenClaw before version 2026.4.15 allows unauthenticated attackers to use rotated out bearer tokens for unauthorized gateway access.

This is an operation on a resource after expiration or release flaw classified under CWE-672, occurring because gateway HTTP and WebSocket handlers fail to re-resolve authentication per request for unauthenticated attackers.

A successful exploit permits unauthorized actors to gain gateway access using revoked credentials, potentially leading to total compromise of confidentiality, integrity, and availability for the affected system. The assigned CVSS score of 8.1 reflects a high severity level due to the potential for total technical impact over network attack vectors.

Immediate Action: Update the npm package openclaw to version 2026.4.15 or later.

Proactive Monitoring: Monitor gateway access logs for unusual patterns of token usage or requests utilizing previously rotated secret references.

Compensating Controls: Implement strict network perimeter controls and rate limiting on gateway endpoints to restrict unauthorized incoming traffic.

Public Exploit Available: false

Given the high severity and potential for total impact on system operations, administrators must apply the available patch immediately. Upgrading openclaw to version 2026.4.15 resolves the stale secret reference issue and ensures per-request token validation is properly enforced.