PT-2026-34774 · Openclaw · Openclaw

Keensecuritylab + 1 · CVE-2026-41343 · Published 2026-04-02 · Updated 2026-04-25

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description The public LINE webhook path lacks a shared pre-authentication concurrency budget. This allows remote attackers to flood the webhook endpoint with concurrent requests before signature verification occurs, leading to resource exhaustion and transient loss of service availability.

Recommendations Update to version 2026.3.31.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-799

Related Identifiers

CVE-2026-41343

GHSA-2HV5-4H3G-4HJV

GHSA-QCC3-JQWP-5VH2

Affected Products

Openclaw

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41343.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-qcc3-jqwp-5vh2 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/57c47d8c7fbf5a2e70cc4dec2380977968903cad · Patch
• https://osv.dev/vulnerability/CVE-2026-41343 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2hv5-4h3g-4hjv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41343 · Security Note
• https://osv.dev/vulnerability/GHSA-qcc3-jqwp-5vh2 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 · Note
• https://vulncheck.com/advisories/openclaw-denial-of-service-via-line-webhook-handler-pre-auth-concurrency · Note
• https://twitter.com/CVEnew/status/2048168365278314985 · Twitter Post