CVE-2026-100571
Received Received - Intake

OpenClaw npm Package SMS Webhook Rate Limit Bypass

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunnel so that multiple external clients share one socket address, an unauthenticated remote sender can exhaust the shared pre-authentication rate-limit budget with invalid requests, causing subsequent correctly signed Twilio callbacks to receive HTTP 429 responses. The result is temporary inbound SMS loss while the shared window remains exhausted; the attacker cannot forge a callback or access message data. Fixed in 2026.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100571
EUVD
EUVD-2026-87480

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openclaw openclaw From 2026.6.6 (inc) to 2026.8.1 (exc)
openclaw openclaw 2026.8.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the OpenClaw npm package versions between 2026.6.6 and 2026.8.1. It involves rate limiting being applied to SMS webhooks before verifying Twilio signatures, identifying clients only by their socket address. When behind a reverse proxy, multiple clients share one address, allowing attackers to exhaust the rate limit with invalid requests, causing legitimate callbacks to be blocked with HTTP 429 errors.

Detection Guidance

To detect this vulnerability, monitor HTTP 429 responses from your OpenClaw webhook endpoint. Check if rate limiting is applied before Twilio signature verification by reviewing proxy logs for shared socket addresses handling multiple clients. Verify OpenClaw version is below 2026.8.1.

Impact Analysis

The impact is temporary loss of inbound SMS messages while the rate limit window is exhausted. Attackers cannot forge callbacks or access message data. The issue primarily affects deployments where Twilio webhooks and untrusted traffic share the same proxy source address.

Compliance Impact

This vulnerability does not directly violate GDPR or HIPAA but may indirectly impact compliance by causing temporary loss of inbound SMS messages, which could disrupt communication required for data processing or patient notifications. The inability to receive critical SMS callbacks may affect record-keeping or consent management processes.

Mitigation Strategies

Upgrade OpenClaw to version 2026.8.1 or later. Avoid placing untrusted traffic and Twilio callbacks behind the same proxy source address. Enforce per-client rate limits at the proxy level to prevent shared socket exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100571. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart