CVE-2026-35646

Received Received - Intake

Pre-Auth Rate-Limit Bypass in OpenClaw Webhook Token Validation

Publication date: 2026-04-09

Last updated on: 2026-04-15

Assigner: VulnCheck

Description

OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak webhook secrets. The vulnerability exists because invalid webhook tokens are rejected without throttling repeated authentication attempts, enabling attackers to guess weak tokens through rapid successive requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-09

Last Modified

2026-04-15

Generated

2026-07-06

AI Q&A

2026-04-10

EPSS Evaluated

2026-07-05

NVD

CVE-2026-35646

EUVD

EUVD-2026-21144

Affected Vendors & Products

Vendor	Product	Version / Range
openclaw	openclaw	to 2026.3.25 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Executive Summary

This vulnerability exists in OpenClaw versions before 2026.3.25 and involves a pre-authentication rate-limit bypass in webhook token validation.

Because invalid webhook tokens are rejected without limiting the number of repeated authentication attempts, attackers can rapidly send many requests to guess weak webhook secrets through brute force.

Impact Analysis

An attacker exploiting this vulnerability can brute-force weak webhook secrets, potentially gaining unauthorized access to webhook functionality.

This could lead to unauthorized actions or information disclosure through the compromised webhook.

Hi! I’m here to help you understand CVE-2026-35646. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70