PT-2026-29238 · Openclaw · Openclaw

Peng Zhou · Publicado 2026-03-31 · Atualizado 2026-03-31 · CVE-2026-34508

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.12

Description The software applies rate limiting only after successful webhook authentication. This allows attackers to bypass rate limits and attempt to brute-force webhook secrets without triggering 429 responses. An attacker can repeatedly guess invalid secrets to discover valid credentials and subsequently submit forged Zalo webhook traffic. The vulnerable component involves the authentication process for webhooks. The webhook authentication is affected.

Recommendations Update to version 2026.3.12 or later.

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

CVE-2026-34508

GHSA-8288-JPQP-95FX

Produtos afetados

Openclaw

Referências · 6

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-5m9r-p9g7-679c · Nota
• https://twitter.com/CVEnew/status/2039004478699929635 · Publicação no Twitter
• https://vulncheck.com/advisories/openclaw-webhook-rate-limiting-bypass-via-pre-authentication-secret-validation-2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-34508 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-8288-jpqp-95fx · Aviso do Fabricante