Is there a patch available for EUVD-2026-21105?

Yes, a patch is available for EUVD-2026-21105. Update the affected software to the latest version immediately.

Openclaw EUVD-2026-21105

Q: What is the CVSS score of EUVD-2026-21105?

EUVD-2026-21105 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-35623 MEDIUM

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-04-09 VulnCheck

GHSA-rc8f-r29c-chr6

Authentication Bypass Openclaw

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 21:45 euvd

EUVD-2026-21105

Analysis Generated

Apr 09, 2026 - 21:45 vuln.today

Patch released

Apr 09, 2026 - 21:45 nvd

Patch available

CVE Published

Apr 09, 2026 - 21:26 nvd

MEDIUM 6.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.24.

DescriptionCVE.org

OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in webhook authentication that allows attackers to brute-force weak webhook passwords without throttling. Remote attackers can repeatedly submit incorrect password guesses to the webhook endpoint to compromise authentication and gain unauthorized access.

AnalysisAI

OpenClaw before version 2026.3.25 allows unauthenticated remote attackers to brute-force webhook authentication credentials due to missing rate limiting on password validation attempts. The vulnerability enables attackers to perform repeated authentication guesses against the webhook endpoint without throttling, potentially compromising webhook security and gaining unauthorized access to webhook functionality.

Technical ContextAI

This vulnerability stems from a missing rate limiting control (CWE-307: Improper Restriction of Rendered UI Layers or Frames, though more accurately CWE-307 encompasses brute force attacks on authentication mechanisms) in OpenClaw's webhook authentication handler. The webhook endpoint fails to implement per-IP, per-session, or account-based rate limiting on failed authentication attempts, allowing attackers to enumerate or guess weak webhook passwords through repeated HTTP requests. The affected product is OpenClaw, an open-source security or infrastructure tooling platform (identified via CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*), with all versions prior to 2026.3.25 vulnerable to this attack.

RemediationAI

Vendor-released patch: upgrade OpenClaw to version 2026.3.25 or later. This version includes rate limiting controls on webhook authentication attempts. The upstream fix is available via commit 5e08ce36d522a1c96df2bfe88e39303ae2643d92 on the OpenClaw GitHub repository. Until patching is possible, implement network-level protections: rate-limit incoming requests to webhook endpoints using a WAF, reverse proxy, or load balancer; monitor failed authentication attempts and alert on repeated failures from the same IP; enforce strong webhook secret policies and rotate secrets regularly. Consult the official GitHub security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-xq8g-hgh6-87hv and the VulnCheck advisory at https://www.vulncheck.com/advisories/openclaw-brute-force-attack-via-missing-webhook-password-rate-limiting for additional guidance.