PT-2026-34764 · Openclaw · Openclaw

Kexna · Published 2026-04-03 · Updated 2026-04-25 · CVE-2026-41333

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description An authentication rate limiting bypass allows attackers to circumvent shared authentication protections by using fake device tokens. By exploiting the mixed WebSocket authentication flow, attackers can bypass rate limiting controls to perform brute force attacks against weak shared passwords.

Recommendations Update to version 2026.3.31.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-799

CWE-307

Related Identifiers

CVE-2026-41333

GHSA-6P8R-6M93-557F

GHSA-W9F5-8Q83-QWPX

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/security/advisories/GHSA-6p8r-6m93-557f · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/af0c0862f22ca4492406a3103d05e3628f94cbe9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41333 · Security Note
• https://osv.dev/vulnerability/GHSA-w9f5-8q83-qwpx · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6p8r-6m93-557f · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 · Note
• https://vulncheck.com/advisories/openclaw-authentication-rate-limiting-bypass-via-fake-devicetoken · Note
• https://twitter.com/CVEnew/status/2048168374530904420 · Twitter Post