PT-2026-34774 · Openclaw · Openclaw

Keensecuritylab + 1 · Published 2026-04-02 · Updated 2026-04-25 · CVE-2026-41343

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description The public LINE webhook path lacks a shared pre-authentication concurrency budget. This allows remote attackers to flood the webhook endpoint with concurrent requests before signature verification occurs, leading to resource exhaustion and transient loss of service availability.

Recommendations Update to version 2026.3.31.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-799

Related Identifiers

CVE-2026-41343

GHSA-2HV5-4H3G-4HJV

GHSA-QCC3-JQWP-5VH2

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/security/advisories/GHSA-qcc3-jqwp-5vh2 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/57c47d8c7fbf5a2e70cc4dec2380977968903cad · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41343 · Security Note
• https://osv.dev/vulnerability/GHSA-qcc3-jqwp-5vh2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2hv5-4h3g-4hjv · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 · Note
• https://vulncheck.com/advisories/openclaw-denial-of-service-via-line-webhook-handler-pre-auth-concurrency · Note
• https://twitter.com/CVEnew/status/2048168365278314985 · Twitter Post