PT-2026-29238 · Openclaw · Openclaw

Peng Zhou · Published 2026-03-31 · Updated 2026-03-31 · CVE-2026-34508

Mitre

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OpenClaw before 2026.3.12 applies rate limiting only after webhook authentication succeeds, allowing attackers to bypass rate limits and brute-force webhook secrets without triggering 429 responses. Attackers can repeatedly guess invalid secrets to discover valid credentials and subsequently submit forged Zalo webhook traffic.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2026-34508

Affected Products

Openclaw

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-34508 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-5m9r-p9g7-679c · Note
• https://vulncheck.com/advisories/openclaw-webhook-rate-limiting-bypass-via-pre-authentication-secret-validation-2 · Note