Brute-Force Vulnerability in OpenClaw Webhook Authentication
Summary
GHSA-rc8f-r29c-chr6: Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xq8g-hgh6-87hv. Affects openclaw versions < 2026.3.24. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source package designed for managing webhooks in various applications. It allows developers to easily integrate and automate workflows by responding to events in real-time. However, prior to version 2026.3.25, OpenClaw had a critical vulnerability related to its webhook authentication mechanism, which lacked proper rate limiting. This oversight made it susceptible to brute-force attacks, where attackers could repeatedly attempt to guess weak passwords without any restrictions.
Vulnerability Detail
The vulnerability in OpenClaw arises from a missing rate limiting feature in its webhook authentication process. This flaw allows remote attackers to submit an unlimited number of incorrect password guesses to the webhook endpoint. As a result, attackers can exploit weak passwords, potentially gaining unauthorized access to sensitive data and functionalities. The absence of throttling mechanisms means that the system does not limit the number of attempts, making it easier for malicious actors to compromise accounts.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update OpenClaw to version 2026.3.25 or later. You can update the package using npm with the following command: npm install openclaw@2026.3.25. This will ensure that the latest security patches are applied, mitigating the risk of brute-force attacks.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing your own rate limiting on the webhook endpoint. This can be done using middleware in your application to limit the number of requests from a single IP address within a specific timeframe. For example, using Express.js, you can use the following code snippet:
const rateLimit = require('express-rate-limit');
const limiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100 // limit each IP to 100 requests per windowMs
});
app.use('/webhook', limiter);
Conclusion
The missing rate limiting vulnerability in OpenClaw's webhook authentication poses a significant risk, allowing attackers to brute-force weak passwords. It is crucial to update to the latest version to mitigate this risk. Implementing rate limiting as a temporary workaround can also help secure your application until the update is applied.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability has a CVSS score of 4.8, indicating a moderate level of risk.
You can use Vulert to monitor your application for vulnerabilities. Simply upload your package-lock.json file to the Vulert playground at Vulert Scanner to check for any issues.
If left unaddressed, attackers could exploit this vulnerability to gain unauthorized access to your application, potentially leading to data breaches or service disruptions.
While updating is the best solution, you can implement rate limiting as a temporary measure to reduce the risk of brute-force attacks.
You can find more information about OpenClaw and its features on its official GitHub repository or documentation page.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.