CVE-2026-100571
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunnel so that multiple external clients share one socket address, an unauthenticated remote sender can exhaust the shared pre-authentication rate-limit budget with invalid requests, causing subsequent correctly signed Twilio callbacks to receive HTTP 429 responses. The result is temporary inbound SMS loss while the shared window remains exhausted; the attacker cannot forge a callback or access message data. Fixed in 2026.8.1.
Risk Assessment
Risk of temporary loss of inbound SMS, which may disrupt communication with customers or service operations.
Recommendation
Update OpenClaw to version 2026.8.1 or later, which includes the fix for SMS webhook rate limiting.
Other vulnerabilities in OpenClaw
See all- CVE-2026-102807Medium
OpenClaw before 2026.9.4 contains an incorrect authorization vulnerability in the mcp.app.view method that allows read-scoped operators to execute MCP App tools requiring operator.write scope. Attackers with operator.read tokens can obtain a standalone ticket from mcp.app.view and redeem it at the MCP app view endpoint to invoke state-changing tools without proper authorization checks.
- CVE-2026-102806Medium
OpenClaw before 2026.9.5 contains an incorrect authorization vulnerability in the Gateway's local media root allowlist that breaks filesystem isolation between sandboxed sessions. Sandboxed sessions or untrusted content can cause the Gateway to read files from sibling session sandboxes or shared workspace directories through media pipeline functions that fail to restrict reads to the active session.
- CVE-2026-45006High
OpenClaw before version 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and config.patch operations, allowing compromised models to write unsafe configuration changes by bypassing an incomplete denylist protection.
- CVE-2026-45004High
OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver that loads setup-api.js from process.cwd() during provider setup metadata resolution. Attackers can execute arbitrary JavaScript under the current user account by placing a malicious extensions/<plugin>/setup-api.js file in a repository.
- CVE-2026-45001High
OpenClaw before version 2026.4.20 contains a guard bypass vulnerability in the config.patch and config.apply endpoints. This vulnerability fails to protect operator-trusted settings such as sandbox policy, plugin enablement, gateway auth/TLS, and MCP server configuration.
- CVE-2026-44995High
OpenClaw before version 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configuration that allows attackers to execute arbitrary code. Malicious workspace configurations can pass dangerous startup variables to MCP server processes.
- CVE-2026-44118High
OpenClaw before version 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can present themselves as owner to bypass owner-gated operations.
- CVE-2026-44115High
OpenClaw before version 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies to execute unapproved commands at runtime.
- CVE-2026-44114High
OpenClaw before version 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dotenv files, allowing attackers to override critical runtime variables. Malicious workspaces can set variables like OPENCLAW_GIT_DIR to manipulate trusted OpenClaw runtime behavior during source-update or installer flows.
- CVE-2026-44110High
OpenClaw before version 2026.4.15 contains an authorization bypass vulnerability in Matrix room control-command authorization. Attackers with DM-paired sender IDs can execute room control commands without being in configured allowlists.
Original NVD description (English source)
OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunnel so that multiple external clients share one socket address, an unauthenticated remote sender can exhaust the shared pre-authentication rate-limit budget with invalid requests, causing subsequent correctly signed Twilio callbacks to receive HTTP 429 responses. The result is temporary inbound SMS loss while the shared window remains exhausted; the attacker cannot forge a callback or access message data. Fixed in 2026.8.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS