OpenClaw CVE-2026-41405

Requires the target OpenClaw instance to have Microsoft Teams webhook functionality enabled and the webhook endpoint to be network-accessible to the attacker (typically internet-exposed for cloud-based Teams integration). No authentication, user interaction, or special configuration required - default OpenClaw deployments with Teams webhooks are exploitable. Attack succeeds against any pre-2026.3.31 version when the /webhook or similar Teams integration endpoint is reachable. Exploitation effectiveness increases if target lacks rate limiting, request size restrictions, or resource consumption controls on webhook processing paths. Limiting factor: impact confined to denial-of-service; attacker cannot escalate to code execution, data access, or persistence through this vulnerability alone.

Real-world risk is MODERATE despite the 8.7 CVSS score. The network attack vector (AV:N) and zero authentication requirement (PR:N) with low complexity (AC:L) make exploitation trivial from any internet-connected host. However, impact is strictly availability degradation (VA:H with VC:N/VI:N) - no data breach or system compromise possible. Not present in CISA KEV, indicating no confirmed active exploitation. No public POC identified, lowering immediate weaponization risk. SSVC decision factors: exploitation status is NONE, automatable is YES (simple HTTP requests), technical impact is PARTIAL (DoS only). Priority depends on whether OpenClaw faces public internet exposure and criticality of webhook-dependent workflows. For internal deployments with network controls, risk is LOW. For internet-facing Teams integrations with limited rate limiting, risk is MODERATE-HIGH for service disruption.

An attacker identifies an internet-facing OpenClaw instance processing Microsoft Teams webhooks through reconnaissance of webhook URLs in Teams channel configurations or public documentation. The attacker crafts malicious HTTP POST requests with oversized or deeply nested JSON payloads targeting the webhook endpoint, deliberately designed to maximize parsing CPU/memory consumption. Without authentication, the server accepts and parses these payloads before JWT validation, exhausting CPU or memory resources and causing service degradation or complete denial-of-service for legitimate Teams integrations.