Is there a patch available for CVE-2026-35628?

Yes, a patch is available for CVE-2026-35628. Update the affected software to the latest version immediately.

Openclaw CVE-2026-35628

Q: What is the CVSS score of CVE-2026-35628?

CVE-2026-35628 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21114 MEDIUM

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-04-09 VulnCheck

GHSA-r4c2-gq3j-7rpj

Information Disclosure Openclaw

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 21:45 euvd

EUVD-2026-21114

Analysis Generated

Apr 09, 2026 - 21:45 vuln.today

Patch released

Apr 09, 2026 - 21:45 nvd

Patch available

CVE Published

Apr 09, 2026 - 21:27 nvd

MEDIUM 6.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.24.

DescriptionCVE.org

OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allows attackers to brute-force weak webhook secrets. The vulnerability enables repeated authentication guesses without throttling, permitting attackers to systematically guess webhook secrets through brute-force attacks.

AnalysisAI

OpenClaw before version 2026.3.25 lacks rate limiting on Telegram webhook authentication, enabling unauthenticated remote attackers to brute-force weak webhook secrets through repeated guesses without throttling. This vulnerability permits systematic credential enumeration, potentially allowing attackers to forge webhook messages and intercept or manipulate Telegram-based communications processed by affected OpenClaw deployments. No public exploit code or active exploitation has been confirmed at this time.

Technical ContextAI

OpenClaw's Telegram webhook integration accepts authentication via shared secrets but fails to implement rate limiting or attempt throttling on webhook secret validation requests. The vulnerability exploits the absence of adaptive access controls (CWE-307: Improper Restriction of Rendered UI Layers or Frames) in the webhook authentication endpoint. Attackers can submit an unlimited number of authentication attempts without computational or temporal delays, reducing the effective entropy of weak secrets to levels susceptible to brute-force enumeration. The affected product is identified by CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* for all versions prior to 2026.3.25.

RemediationAI

Upgrade OpenClaw to version 2026.3.25 or later, which includes rate limiting on webhook authentication endpoints. The patch is available via the upstream commit c2c136ae9517ddd0789d742a0fdf4c10e8c729a7 (https://github.com/openclaw/openclaw/commit/c2c136ae9517ddd0789d742a0fdf4c10e8c729a7). As a temporary workaround pending upgrade, configure reverse proxy or load balancer rules to throttle repeated authentication attempts to the webhook endpoint, limiting requests per source IP to one per second or fewer. Additionally, audit and rotate all Telegram webhook secrets to strong, cryptographically random values (minimum 32 bytes) to reduce brute-force attack surface. Reference the full advisory at https://www.vulncheck.com/advisories/openclaw-brute-force-attack-via-missing-telegram-webhook-rate-limiting for additional context.