EUVD-2026-21476Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Blast Radius
ecosystem impact- 3 npm packages depend on openclaw (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.24.
DescriptionCVE.org
OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-32011 where the Feishu webhook handler accepts request bodies with permissive limits of 1MB and 30-second timeout before signature verification. An unauthenticated attacker can exhaust server connection resources by sending concurrent slow HTTP POST requests to the Feishu webhook endpoint, blocking legitimate webhook deliveries.
AnalysisAI
OpenClaw before version 2026.3.24 allows unauthenticated remote denial of service via the Feishu webhook handler, which accepts request bodies up to 1MB with a 30-second timeout before verifying the request signature. An attacker can exhaust server connection resources by sending concurrent slow HTTP POST requests, blocking legitimate webhook deliveries and degrading service availability. This is an incomplete remediation of the earlier CVE-2026-32011.
Technical ContextAI
The vulnerability exists in OpenClaw's Feishu webhook integration, a webhook handler for the Feishu (DingTalk) enterprise collaboration platform. The root cause is classified as CWE-405 (Uncontrolled Request Size), stemming from a failure to enforce strict request validation prior to signature verification. The handler accepts bodies up to 1MB and waits up to 30 seconds before cryptographic signature validation occurs. This design permits an attacker to establish many concurrent TCP connections and send slow HTTP requests (slowloris-style attack), forcing the server to allocate connection state and buffers for each request. Because signature verification happens after these resource-intensive steps, an attacker can amplify resource consumption without providing valid HMAC or JWT credentials. The webhook endpoint is exposed to unauthenticated access (PR:N in CVSS vector), making this a pre-authentication denial of service vector.
RemediationAI
Upgrade OpenClaw to version 2026.3.24 or later, which contains the corrected webhook handler implementation. Per the GitHub security advisory (https://github.com/openclaw/openclaw/security/advisories/GHSA-w6m8-cqvj-pg5v), this release addresses the incomplete fix from CVE-2026-32011 by implementing strict request validation before signature verification. If immediate patching is not possible, implement network-layer mitigation by rate-limiting or IP-blocking connections to the Feishu webhook endpoint (/path/to/feishu/webhook or equivalent), or by placing the OpenClaw instance behind a reverse proxy with connection pooling and request timeout enforcement (e.g., nginx with client_max_body_size and proxy_connect_timeout directives). Additionally, monitor connection counts and request latency to the webhook endpoint for signs of slow-request attack patterns.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today