PT-2026-34764 · Openclaw · Openclaw

Kexna · CVE-2026-41333 · Published 2026-04-03 · Updated 2026-04-25

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description An authentication rate limiting bypass allows attackers to circumvent shared authentication protections by using fake device tokens. By exploiting the mixed WebSocket authentication flow, attackers can bypass rate limiting controls to perform brute force attacks against weak shared passwords.

Recommendations Update to version 2026.3.31.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-799

CWE-307

Related Identifiers

CVE-2026-41333

GHSA-6P8R-6M93-557F

GHSA-W9F5-8Q83-QWPX

Affected Products

Openclaw

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41333.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-6p8r-6m93-557f · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/af0c0862f22ca4492406a3103d05e3628f94cbe9 · Patch
• https://osv.dev/vulnerability/GHSA-w9f5-8q83-qwpx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41333 · Security Note
• https://osv.dev/vulnerability/GHSA-6p8r-6m93-557f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-41333 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 · Note
• https://vulncheck.com/advisories/openclaw-authentication-rate-limiting-bypass-via-fake-devicetoken · Note
• https://twitter.com/CVEnew/status/2048168374530904420 · Twitter Post