PT-2026-29236 · Openclaw · Openclaw

Peng Zhou · Published 2026-03-13 · Updated 2026-03-31 · CVE-2026-34505

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.12

Description The software applies rate limiting only after successful webhook authentication. This allows attackers to bypass rate limits and attempt to brute-force webhook secrets. Repeated authentication requests with invalid secrets do not trigger rate limit responses, enabling systematic secret guessing and subsequent forged webhook submission.

Recommendations Update OpenClaw to version 2026.3.12 or later.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2026-34505

GHSA-5M9R-P9G7-679C

GHSA-CXFR-3QP8-HPMW

Affected Products

Openclaw

References · 12

• https://github.com/openclaw/openclaw/security/advisories/GHSA-5m9r-p9g7-679c · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5m9r-p9g7-679c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34505 · Security Note
• https://osv.dev/vulnerability/GHSA-cxfr-3qp8-hpmw · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/commit/f96ba87f033a14183fa0ede912df3a592eef55ff · Note
• https://github.com/openclaw/openclaw/pull/44173 · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.12 · Note
• https://twitter.com/CveFindCom/status/2038960447844475058 · Twitter Post
• https://vulncheck.com/advisories/openclaw-webhook-rate-limiting-bypass-via-pre-authentication-secret-validation · Note
• https://twitter.com/TheHackerWire/status/2038955551212855628 · Twitter Post
• https://twitter.com/CVEnew/status/2039004480776122492 · Twitter Post