PT-2026-26226 · Openclaw · Openclaw

Migraine + 1 · Publicado 2026-03-02 · Atualizado 2026-03-21 · CVE-2026-28461

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.1

Description OpenClaw contains a memory growth issue in the Zalo webhook endpoint. Unauthenticated attackers can cause memory accumulation by manipulating query strings. Repeated requests with varying query parameters can lead to memory pressure, process instability, or out-of-memory conditions, potentially impacting service availability. The affected API endpoint is the Zalo webhook. Attackers exploit this by sending requests with different query parameters to the Zalo webhook endpoint. The query strings are the vulnerable parameters.

Recommendations Update OpenClaw to version 2026.3.1 or later.

Correção

Allocation of Resources Without Limits

Resource Exhaustion

Enumeração de Fraquezas

CWE-770

CWE-400

Identificadores relacionados

BDU:2026-05017

CVE-2026-28461

GHSA-WR6M-JG37-68XH

Produtos afetados

Openclaw

Referências · 12

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-wr6m-jg37-68xh · Aviso do Fabricante
• https://twitter.com/CVEarity/status/2035247440367112510 · Publicação no Twitter
• https://twitter.com/vuln_tracker/status/2034696935341224267 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-wr6m-jg37-68xh · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-28461 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2034521595557924894 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-05017 · Nota de Segurança
• https://twitter.com/CVEnew/status/2034520397819875637 · Publicação no Twitter
• https://twitter.com/RedPacketSec/status/2034508372230169046 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-28461 · Nota de Segurança
• https://vulncheck.com/advisories/openclaw-unbounded-memory-growth-in-zalo-webhook-via-query-string-key-churn · Nota