CVE-2026-35623

Received Received - Intake

Missing Rate Limiting in OpenClaw Webhook Enables Brute-Force Access

Publication date: 2026-04-09

Last updated on: 2026-04-16

Assigner: VulnCheck

Description

OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in webhook authentication that allows attackers to brute-force weak webhook passwords without throttling. Remote attackers can repeatedly submit incorrect password guesses to the webhook endpoint to compromise authentication and gain unauthorized access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-09

Last Modified

2026-04-16

Generated

2026-07-06

AI Q&A

2026-04-10

EPSS Evaluated

2026-07-05

NVD

CVE-2026-35623

EUVD

EUVD-2026-21105

Affected Vendors & Products

Vendor	Product	Version / Range
openclaw	openclaw	to 2026.3.25 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Executive Summary

This vulnerability exists in OpenClaw versions before 2026.3.25 and involves a missing rate limiting mechanism in the webhook authentication process.

Because there is no throttling, attackers can repeatedly submit incorrect password guesses to the webhook endpoint, allowing them to brute-force weak webhook passwords.

Successful exploitation can lead to compromised authentication and unauthorized access.

Impact Analysis

The vulnerability allows remote attackers to gain unauthorized access by brute-forcing weak webhook passwords.

This unauthorized access can lead to potential compromise of the system or data accessible through the webhook.

Hi! I’m here to help you understand CVE-2026-35623. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70