CVE-2026-34505CWE-307

OpenClaw < 2026.3.12 - Webhook Rate Limiting Bypass via Pre-Authentication Secret Validation

Medium · published March 31, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
28.2
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets without triggering rate limit responses, enabling systematic secret guessing and subsequent forged webhook submission.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00357 · 28.2th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2026-03-31T11:17Z
EPSS history
Timeline
  • 31 MAR 11:17Z
    OpenClaw < 2026.3.12 - Webhook Rate Limiting Bypass via Pre-Authentication Secret Validation
    cvelistv5