PT-2026-29236 · Openclaw · Openclaw

Peng Zhou · Published 2026-03-31 · Updated 2026-03-31 · CVE-2026-34505

NVD

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets without triggering rate limit responses, enabling systematic secret guessing and subsequent forged webhook submission.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2026-34505

Affected Products

Openclaw

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-34505 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-5m9r-p9g7-679c · Note
• https://vulncheck.com/advisories/openclaw-webhook-rate-limiting-bypass-via-pre-authentication-secret-validation · Note