PT-2026-31779 · Openclaw · Openclaw

Peng Zhou · Published 2026-03-29 · Updated 2026-04-10 · CVE-2026-35646

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.25

Description OpenClaw is susceptible to a pre-authentication rate-limit bypass in its webhook token validation process. This allows attackers to attempt to brute-force weak webhook secrets due to the lack of throttling on repeated authentication attempts with invalid tokens.

Recommendations Update OpenClaw to version 2026.3.25 or later.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-521

CWE-307

Related Identifiers

CVE-2026-35646

GHSA-59XC-5V89-R7PR

GHSA-MF5G-6R6F-GHHM

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/commit/0b4d07337467f4d40a0cc1ced83d45ceaec0863c · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-mf5g-6r6f-ghhm · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-59xc-5v89-r7pr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35646 · Security Note
• https://osv.dev/vulnerability/GHSA-mf5g-6r6f-ghhm · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-pre-authentication-rate-limit-bypass-in-webhook-token-validation · Note
• https://twitter.com/infoflowcloud/status/2042366074893545822 · Twitter Post
• https://twitter.com/CVEnew/status/2042364312044425432 · Twitter Post