OpenClaw Vulnerability: Auth Lockout Triggered by Non-POST Requests
Summary
GHSA-6rmx-gvvg-vh6j: OpenClaw's hooks count non-POST requests toward auth lockout. Affects openclaw versions < 2026.3.7. Fixed in 2026.3.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source package designed for handling webhooks, allowing applications to automate tasks based on events. It provides a mechanism for clients to send HTTP requests to trigger specific actions. However, it has a vulnerability that allows unauthenticated clients to exploit the authentication mechanism, leading to potential service disruptions.
Vulnerability Detail
The vulnerability arises from OpenClaw's HTTP handler, which incorrectly counts authentication failures for non-POST requests. An unauthenticated client can repeatedly send invalid non-POST requests (like GET) to consume the authentication failure budget, resulting in a temporary lockout for legitimate webhook deliveries. This issue primarily affects clients using shared proxies or NAT topologies, causing temporary availability loss for hook-triggered automation.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.3.7
This is the first release that contains the fix.
npm install openclaw@2026.3.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as soon as possible.
Conclusion
The OpenClaw package has a vulnerability that allows unauthenticated clients to exploit the authentication mechanism, leading to potential service disruptions. It is crucial to update to the patched version 2026.3.7 to mitigate this risk and ensure the proper functioning of webhook deliveries.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability allows unauthenticated clients to trigger authentication lockouts by sending repeated non-POST requests, which can disrupt legitimate webhook deliveries.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
The primary mitigation step is to update the OpenClaw package to version 2026.3.7 or later to ensure the vulnerability is patched.
If left unaddressed, this vulnerability could lead to temporary service disruptions for webhook-triggered actions, affecting automation and task execution.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
