Which versions of Openclaw are affected by CVE-2026-32980?

OpenClaw versions before 2026.3.13 contain an unauthenticated resource exhaustion vulnerability in webhook processing that allows remote attackers to crash or degrade service availability by sending…. A patch is available.

How to fix or mitigate CVE-2026-32980?

Within 24 hours: Identify all OpenClaw deployments and their current versions. Within 7 days: Upgrade OpenClaw to version 2026.3.13 or later across all production and non-production environments. Within 30 days: Review webhook endpoint access controls and implement rate limiting or IP allowlisting to restrict Telegram webhook sources as defense-in-depth.

Openclaw CVE-2026-32980

Q: What is the CVSS score of CVE-2026-32980?

CVE-2026-32980 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-17020 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-03-29 VulnCheck

GHSA-jq3f-vjww-8rq7

Denial Of Service Openclaw

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 29, 2026 - 13:15 euvd

EUVD-2026-17020

Analysis Generated

Mar 29, 2026 - 13:15 vuln.today

Patch released

Mar 29, 2026 - 13:15 nvd

Patch available

CVE Published

Mar 29, 2026 - 12:44 nvd

HIGH 8.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

9 npm packages depend on openclaw (5 direct, 4 indirect)

Ecosystem-wide dependent count for version 2026.3.13.

DescriptionCVE.org

OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests to the webhook endpoint to force memory consumption, socket time, and JSON parsing work before authentication validation occurs.

AnalysisAI

Resource exhaustion in OpenClaw webhook endpoint allows remote attackers to consume server memory and processing resources via unauthenticated Telegram webhook POST requests. OpenClaw versions prior to 2026.3.13 process and buffer entire request bodies before validating authentication tokens, enabling denial-of-service attacks with no authentication required. CVSS 8.7 (High) reflects network-accessible, low-complexity attack with high availability impact. No public exploit identified at time of analysis, though the attack technique is straightforward given the architectural flaw.

Technical ContextAI

This vulnerability stems from an insecure request processing order in OpenClaw's Telegram webhook handler implementation. The application reads, buffers, and begins JSON parsing of incoming POST request bodies before performing authentication validation via the x-telegram-bot-api-secret-token header. This represents a classic CWE-770 (Allocation of Resources Without Limits or Throttling) flaw where resource-intensive operations occur in the unauthenticated request path. The Telegram Bot API uses webhook endpoints to deliver updates via HTTP POST with JSON payloads, and the secret token header serves as the authentication mechanism. By processing potentially large payloads before authentication, the application creates an amplification opportunity where attackers can force disproportionate server resource consumption with minimal client effort. The affected component is the webhook request handler in the OpenClaw application, which integrates with Telegram's Bot API for receiving messages and updates.

RemediationAI

Vendor-released patch: Upgrade to OpenClaw version 2026.3.13 or later, which implements authentication validation before resource-intensive request processing operations. The fix is available via commit 7e49e98f79073b11134beac27fdff547ba5a4a02 in the official GitHub repository at https://github.com/openclaw/openclaw/commit/7e49e98f79073b11134beac27fdff547ba5a4a02. Organizations unable to immediately upgrade should implement compensating controls including rate limiting at the web server or load balancer level, request size restrictions on the webhook endpoint, and network-level access controls to restrict webhook POST requests to Telegram's published IP ranges. Deploy web application firewall rules to detect and block anomalous patterns of large POST requests to webhook endpoints. Monitor server resources for unusual memory consumption or request volumes targeting the webhook URL. Review application logs for authentication failures or malformed requests that may indicate reconnaissance or active exploitation attempts. Consult the official security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-jq3f-vjww-8rq7 for additional vendor guidance.