{"action":"Upgrade openclaw to 2026.4.20 or later.","affected":[{"fixed":"2026.4.20","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-45002"],"ecosystem":"npm","epss":0.0028,"exploited":false,"fixed_versions":["2026.4.20"],"ghsa_id":"GHSA-2xcp-x87w-q377","id":"tcs_01M5KEVD6KTF8WNDKHXR07494B","modified_at":"2026-05-19T16:11:27.635255Z","published_at":"2026-04-25T23:45:11Z","references":["https://osv.dev/vulnerability/GHSA-2xcp-x87w-q377","https://github.com/openclaw/openclaw/security/advisories/GHSA-2xcp-x87w-q377","https://nvd.nist.gov/vuln/detail/CVE-2026-45002","https://github.com/openclaw/openclaw/commit/5275d008ed33203dba3f98e969ad683a65c416c3","https://github.com/openclaw/openclaw","https://www.vulncheck.com/advisories/openclaw-hook-session-key-bypass-via-template-mapping"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-2xcp-x87w-q377","url":"https://osv.dev/vulnerability/GHSA-2xcp-x87w-q377"},{"source":"nvd","source_id":"CVE-2026-45002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45002"}],"summary":"OpenClaw: Hook mapping templates could bypass hook session-key opt-in"}