Pre-Authentication Rate-Limit Bypass in OpenClaw Webhook Token Validation

CVE-2026-35646

What is CVE-2026-35646?

OpenClaw versions before 2026.3.25 exhibit a vulnerability in their webhook token validation process, where the lack of throttling for failed authentication attempts allows attackers to perform brute-force attacks on weak webhook secrets. This flaw enables unauthorized users to make repeated requests, effectively bypassing intended security mechanisms and increasing the risk of exploitation. Organizations using earlier versions of OpenClaw must apply the necessary updates to mitigate the threat posed by this vulnerability.

References