CVE-2026-41913
Race Condition in OpenClaw Authentication Bypasses Rate Limiting
Publication date: 2026-04-28
Last updated on: 2026-04-30
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.4.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-41913 is a race condition vulnerability in OpenClaw versions before 2026.4.4 that affects the shared-secret authentication mechanism.
This flaw allows attackers to send multiple concurrent asynchronous authentication requests that bypass the intended per-key rate-limit budget on Tailscale-capable paths.
Because of this race condition, the rate-limiting protections designed to limit authentication attempts can be circumvented, enabling attackers to exceed allowed authentication attempts.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of CVE-2026-41913 on compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability impact me? :
This vulnerability can allow attackers to bypass rate-limiting controls on authentication attempts, potentially leading to abuse of authentication resources.
By circumventing the per-key rate-limit, attackers might perform a higher number of authentication attempts than intended, which could increase the risk of unauthorized access attempts or denial of service on authentication mechanisms.
However, the vulnerability does not impact confidentiality, integrity, availability, or scope according to the CVSS v4 vector.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade OpenClaw to version 2026.4.4 or later, where the race condition issue in shared-secret authentication has been fixed.
This update resolves the concurrency issue that allowed attackers to bypass the per-key rate-limit by sending multiple simultaneous authentication attempts.