CVE-2026-34505
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
OpenClaw before version 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets without triggering rate limit responses, enabling systematic secret guessing and subsequent forged webhook submission.
Risk Assessment
An attacker can guess the webhook secret and send forged requests, potentially leading to unauthorized actions or data leakage.
Recommendation
Upgrade OpenClaw to version 2026.3.12 or later. If an update is not possible, implement rate limiting before authentication.
Original NVD description (English source)
OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets without triggering rate limit responses, enabling systematic secret guessing and subsequent forged webhook submission.