PT-2026-29236 · Openclaw · Openclaw

Peng Zhou · CVE-2026-34505 · Publicado 2026-03-13 · Atualizado 2026-03-31

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.12

Description The software applies rate limiting only after successful webhook authentication. This allows attackers to bypass rate limits and attempt to brute-force webhook secrets. Repeated authentication requests with invalid secrets do not trigger rate limit responses, enabling systematic secret guessing and subsequent forged webhook submission.

Recommendations Update OpenClaw to version 2026.3.12 or later.

Exploit

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

CVE-2026-34505

GHSA-5M9R-P9G7-679C

GHSA-CXFR-3QP8-HPMW

Produtos afetados

Openclaw

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34505.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-5m9r-p9g7-679c · Aviso do Fabricante
• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/pull/44173 · Nota
• https://github.com/openclaw/openclaw/commit/f96ba87f033a14183fa0ede912df3a592eef55ff · Nota
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.12 · Nota
• https://osv.dev/vulnerability/GHSA-cxfr-3qp8-hpmw · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-34505 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-5m9r-p9g7-679c · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-webhook-rate-limiting-bypass-via-pre-authentication-secret-validation · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-34505 · Nota de Segurança
• https://twitter.com/CVEnew/status/2039004480776122492 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2038960447844475058 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2038955551212855628 · Publicação no Twitter