PT-2026-30784 · Npm · Openclaw

Publicado 2026-03-27 · Atualizado 2026-03-27

OSV

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

BlueBubbles Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Password

Affected Packages / Versions

• Package: openclaw
• Affected versions: <= 2026.3.24
• First patched version: 2026.3.25
• Latest published npm version at verification time: 2026.3.24

Details

BlueBubbles webhook auth previously rejected wrong passwords without throttling repeated guesses, allowing brute-force attempts against weak webhook passwords. Commit 5e08ce36d522a1c96df2bfe88e39303ae2643d92 adds repeated-guess throttling before auth failure responses.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 5e08ce36d522a1c96df2bfe88e39303ae2643d92.

Fix Commit(s)

• 5e08ce36d522a1c96df2bfe88e39303ae2643d92

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-521

CWE-307

Identificadores relacionados

GHSA-XQ8G-HGH6-87HV

Produtos afetados

Openclaw

Referências · 6

• https://github.com/openclaw/openclaw · Nota
• https://github.com/openclaw/openclaw/commit/5e08ce36d522a1c96df2bfe88e39303ae2643d92 · Nota
• https://github.com/openclaw/openclaw/security/advisories/GHSA-xq8g-hgh6-87hv · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-35623 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-xq8g-hgh6-87hv · Aviso do Fabricante
• https://vulncheck.com/advisories/openclaw-brute-force-attack-via-missing-webhook-password-rate-limiting · Nota