PT-2026-29238 · Openclaw · Openclaw

Peng Zhou · Published 2026-03-31 · Updated 2026-03-31 · CVE-2026-34508

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.12

Description The software applies rate limiting only after successful webhook authentication. This allows attackers to bypass rate limits and attempt to brute-force webhook secrets without triggering 429 responses. An attacker can repeatedly guess invalid secrets to discover valid credentials and subsequently submit forged Zalo webhook traffic. The vulnerable component involves the authentication process for webhooks. The webhook authentication is affected.

Recommendations Update to version 2026.3.12 or later.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2026-34508

GHSA-8288-JPQP-95FX

Affected Products

Openclaw

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-34508 · Security Note
• https://osv.dev/vulnerability/GHSA-8288-jpqp-95fx · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-5m9r-p9g7-679c · Note
• https://twitter.com/CVEnew/status/2039004478699929635 · Twitter Post
• https://vulncheck.com/advisories/openclaw-webhook-rate-limiting-bypass-via-pre-authentication-secret-validation-2 · Note