PT-2026-35788 · Openclaw · Openclaw

Antaisecuritylab · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-41405

Mitre

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhaustion. Remote attackers can send malicious Teams webhook payloads to exhaust server resources by bypassing authentication checks.

Fix

Weakness Enumeration

CWE-408

Related Identifiers

CVE-2026-41405

Affected Products

Openclaw

References · 5

• https://github.com/openclaw/openclaw/security/advisories/GHSA-p464-m8x6-vhv8 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/3834d47099dd13c8244ed6de8b9ea9855c553623 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41405 · Security Note
• https://twitter.com/CVEnew/status/2049227515688849457 · Twitter Post
• https://vulncheck.com/advisories/openclaw-resource-exhaustion-via-unauthenticated-ms-teams-webhook-body-parsing · Note