OpenClaw Timing Side Channel Vulnerability in Shared-Secret Comparison

A timing side channel vulnerability has been identified in OpenClaw versions prior to 2026.4.2. The issue arises in shared-secret comparison call sites that rely on early length-mismatch checks instead of using fixed-length comparison helpers. This vulnerability allows attackers to measure timing differences and infer secret-length information, thereby undermining the constant-time handling of shared secrets.

Impact

Exploitation of this vulnerability creates a low-severity timing side channel that could leak length information of shared secrets, potentially leading to an authentication bypass, although such an outcome is not guaranteed.

Remediation

Users can upgrade to OpenClaw version 2026.4.2 or later to address this vulnerability.