{"id":"CVE-2026-34505","title":"OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets","summary":"OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid se…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cwe":["CWE-307"],"vendor":"openclaw","product":"openclaw","affected":["openclaw < 2026.3.12"],"patched":["openclaw 2026.3.12"],"published":"2026-03-31","updated":"2026-07-24","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34505","references":[{"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5m9r-p9g7-679c","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openclaw-webhook-rate-limiting-bypass-via-pre-authentication-secret-validation","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.00272,"epssPercentile":0.19819,"ingestedAt":"2026-07-24T22:40:25.282Z","slug":"CVE-2026-34505","body":"## Overview\n\nOpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets without triggering rate limit responses, enabling systematic secret guessing and subsequent forged webhook submission.\n\n## Affected\n\n- `openclaw < 2026.3.12`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `openclaw 2026.3.12`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}