PT-2026-31759 · Openclaw · Openclaw

Peng Zhou · Published 2026-03-27 · Updated 2026-04-10 · CVE-2026-35623

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.25

Description OpenClaw is susceptible to a missing rate limiting issue in its webhook authentication process. This allows attackers to attempt to guess weak webhook passwords without any restrictions. Repeated, incorrect password submissions to the webhook endpoint can lead to compromised authentication and unauthorized access.

Recommendations Update OpenClaw to version 2026.3.25 or later.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-521

CWE-307

Related Identifiers

CVE-2026-35623

GHSA-RC8F-R29C-CHR6

GHSA-XQ8G-HGH6-87HV

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/commit/5e08ce36d522a1c96df2bfe88e39303ae2643d92 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-xq8g-hgh6-87hv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35623 · Security Note
• https://osv.dev/vulnerability/GHSA-xq8g-hgh6-87hv · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rc8f-r29c-chr6 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2042561819995500817 · Twitter Post
• https://vulncheck.com/advisories/openclaw-brute-force-attack-via-missing-webhook-password-rate-limiting · Note