PT-2026-30782 · Npm · Openclaw

Publicado 2026-03-27 · Atualizado 2026-03-27

OSV

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret

Affected Packages / Versions

• Package: openclaw
• Affected versions: <= 2026.3.24
• First patched version: 2026.3.25
• Latest published npm version at verification time: 2026.3.24

Details

Telegram webhook auth previously rejected bad secrets but did not throttle repeated guesses, allowing brute-force attempts against weak webhook secrets. Commit c2c136ae9517ddd0789d742a0fdf4c10e8c729a7 adds repeated-guess throttling before auth failure responses.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit c2c136ae9517ddd0789d742a0fdf4c10e8c729a7.

Fix Commit(s)

• c2c136ae9517ddd0789d742a0fdf4c10e8c729a7

Release Process Note

2026.3.25 is the next planned OpenClaw release version in package.json. This advisory is being published ahead of that npm release so the draft is no longer blocked; once 2026.3.25 is published, the structured patched-version metadata will match the released artifact.

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

CWE-521

Identificadores relacionados

GHSA-VCX4-4QXG-MFP4

Produtos afetados

Openclaw

Referências · 6

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/commit/c2c136ae9517ddd0789d742a0fdf4c10e8c729a7 · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-vcx4-4qxg-mfp4 · Nota
• https://vulncheck.com/advisories/openclaw-brute-force-attack-via-missing-telegram-webhook-rate-limiting · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-35628 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-vcx4-4qxg-mfp4 · Aviso do Fabricante