Which versions of Openclaw are affected by CVE-2026-34505?

OpenClaw versions before 2026.3.12 contain a critical vulnerability allowing unauthenticated attackers to brute-force webhook secrets and forge authenticated webhook payloads, potentially enabling…. A patch is available.

How to fix or mitigate CVE-2026-34505?

Within 24 hours: Identify all systems running OpenClaw and document current versions; disable or restrict external webhook endpoints if operationally feasible pending patching. Within 7 days: Implement network-level rate limiting on webhook endpoints independent of application logic; review webhook processing logs for suspicious patterns or forged payloads; enable additional authentication layers (IP whitelisting, mutual TLS, signed request validation) on webhook receivers. Within 30 days: Upgrade to OpenClaw 2026.3.12 or later once vendor releases patch; rotate all webhook secrets; audit webhook execution history for unauthorized actions.

Openclaw CVE-2026-34505

Q: What is the CVSS score of CVE-2026-34505?

CVE-2026-34505 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-17389 MEDIUM

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-03-31 VulnCheck

Authentication Bypass Openclaw

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 07, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 11:45 euvd

EUVD-2026-17389

Analysis Generated

Mar 31, 2026 - 11:45 vuln.today

CVE Published

Mar 31, 2026 - 11:17 nvd

MEDIUM 6.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on openclaw (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.12.

DescriptionCVE.org

OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets without triggering rate limit responses, enabling systematic secret guessing and subsequent forged webhook submission.

AnalysisAI

Webhook secret brute-forcing in OpenClaw before 2026.3.12 enables attackers to forge authenticated webhooks by exploiting pre-authentication rate limit bypass. Unauthenticated remote attackers can systematically guess webhook secrets without triggering rate limiting (which only applies post-authentication), then submit forged webhook payloads to compromise system integrity and confidentiality. CVSS 9.8 (Critical) with network attack vector and no authentication required. No public exploit identified at time of analysis, though exploitation requires only standard HTTP tooling. EPSS data not available; exploitation appears automatable given the straightforward nature of brute-force attacks against webhook endpoints.

Technical ContextAI

This vulnerability affects OpenClaw's webhook authentication mechanism, specifically the interaction between rate limiting and secret validation logic (CWE-307: Improper Restriction of Excessive Authentication Attempts). Webhooks are HTTP callbacks commonly used for event-driven integrations, authenticated via shared secrets. The implementation flaw places rate limiting enforcement after the authentication validation step rather than before it, creating a logical ordering vulnerability. This architecture allows attackers to submit unlimited authentication attempts against the webhook endpoint, as the rate limiter never sees failed authentication requests. CPE 2.3:a:openclaw:openclaw identifies all OpenClaw versions prior to the March 2026 security release as vulnerable. The weakness represents a defense-in-depth failure where security controls (rate limiting) are positioned incorrectly in the request processing pipeline.

RemediationAI

Upgrade to OpenClaw version 2026.3.12 or later, which corrects the rate limiting logic to apply before authentication validation rather than after. The patch repositions rate limiting enforcement earlier in the webhook request processing pipeline, ensuring all authentication attempts count against rate limits regardless of success or failure. Detailed upgrade instructions are available in the GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-5m9r-p9g7-679c. As an interim mitigation if immediate patching is not feasible, consider implementing network-layer rate limiting (via WAF, reverse proxy, or firewall rules) on webhook endpoints to restrict requests per source IP, rotate webhook secrets to invalidate any potentially compromised credentials, and monitor webhook authentication logs for unusual patterns of repeated failed authentication attempts. However, these workarounds provide incomplete protection and should not replace patching.