Pre-Auth Rate-Limit Bypass in OpenClaw: A Security Concern
Summary
GHSA-59xc-5v89-r7pr: Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mf5g-6r6f-ghhm. Affects openclaw versions < 2026.3.28. Fixed in 2026.3.28. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source package designed for managing webhooks and facilitating communication between applications. It allows developers to integrate various services seamlessly. However, a significant vulnerability has been identified in versions prior to 2026.3.25, which compromises the security of webhook token validation.
Vulnerability Detail
The vulnerability in OpenClaw arises from a pre-authentication rate-limit bypass in webhook token validation. This flaw allows attackers to exploit the system by sending rapid successive requests to guess weak webhook secrets. The lack of throttling on invalid token attempts means that attackers can brute-force these tokens without facing any restrictions, potentially leading to unauthorized access and manipulation of webhook functionalities.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.3.28
This is the first release that contains the fix.
npm install openclaw@2026.3.28Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional rate limiting on your server to mitigate the risk of brute-force attacks. This can be done by configuring your server to limit the number of requests from a single IP address within a specific timeframe.
Conclusion
In summary, the pre-authentication rate-limit bypass vulnerability in OpenClaw poses a significant risk to applications using this package. It is crucial to update to the latest version to mitigate potential threats. Additionally, implementing temporary workarounds can help secure your application until the update is applied.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability allows attackers to bypass rate limits on invalid webhook token attempts, enabling brute-force guessing of weak tokens.
OpenClaw versions prior to 2026.3.25 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
If an immediate update is not possible, implement additional rate limiting on your server as a temporary measure to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.