CVE-2026-35646
Received Received - Intake
Pre-Auth Rate-Limit Bypass in OpenClaw Webhook Token Validation

Publication date: 2026-04-09

Last updated on: 2026-04-15

Assigner: VulnCheck

Description
OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak webhook secrets. The vulnerability exists because invalid webhook tokens are rejected without throttling repeated authentication attempts, enabling attackers to guess weak tokens through rapid successive requests.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-09
Last Modified
2026-04-15
Generated
2026-06-16
AI Q&A
2026-04-10
EPSS Evaluated
2026-06-15
NVD
CVE-2026-35646
EUVD
EUVD-2026-21144
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
openclaw openclaw to 2026.3.25 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in OpenClaw versions before 2026.3.25 and involves a pre-authentication rate-limit bypass in webhook token validation.

Because invalid webhook tokens are rejected without limiting the number of repeated authentication attempts, attackers can rapidly send many requests to guess weak webhook secrets through brute force.

Impact Analysis

An attacker exploiting this vulnerability can brute-force weak webhook secrets, potentially gaining unauthorized access to webhook functionality.

This could lead to unauthorized actions or information disclosure through the compromised webhook.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-35646. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart