PT-2026-26226 · Openclaw · Openclaw

Migraine + 1 · Published 2026-03-02 · Updated 2026-03-21 · CVE-2026-28461

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.1

Description OpenClaw contains a memory growth issue in the Zalo webhook endpoint. Unauthenticated attackers can cause memory accumulation by manipulating query strings. Repeated requests with varying query parameters can lead to memory pressure, process instability, or out-of-memory conditions, potentially impacting service availability. The affected API endpoint is the Zalo webhook. Attackers exploit this by sending requests with different query parameters to the Zalo webhook endpoint. The query strings are the vulnerable parameters.

Recommendations Update OpenClaw to version 2026.3.1 or later.

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

BDU:2026-05017

CVE-2026-28461

GHSA-WR6M-JG37-68XH

Affected Products

Openclaw

References · 12

• https://github.com/openclaw/openclaw/security/advisories/GHSA-wr6m-jg37-68xh · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05017 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28461 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28461 · Security Note
• https://osv.dev/vulnerability/GHSA-wr6m-jg37-68xh · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/VulmonFeeds/status/2034521595557924894 · Twitter Post
• https://twitter.com/RedPacketSec/status/2034508372230169046 · Twitter Post
• https://twitter.com/CVEarity/status/2035247440367112510 · Twitter Post
• https://vulncheck.com/advisories/openclaw-unbounded-memory-growth-in-zalo-webhook-via-query-string-key-churn · Note
• https://twitter.com/CVEnew/status/2034520397819875637 · Twitter Post
• https://twitter.com/vuln_tracker/status/2034696935341224267 · Twitter Post