CVE-2026-100571: OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass
OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunnel so that multiple external clients share one socket address, an unauthenticated remote sender can exhaust the shared pre-authentication rate-limit budget with invalid requests, causing subsequent correctly signed Twilio callbacks to receive HTTP 429 responses. The result is temporary inbound SMS loss while the shared window remains exhausted; the attacker cannot forge a callback or access message data. Fixed in 2026.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/openclawto a version that resolves this vulnerability.Fixed in 2026.8.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments of affected versions are exposed when the SMS/Twilio webhook is behind a trusted reverse proxy or tunnel that causes multiple external clients to appear under the same raw proxy socket address. Deployments without that shared-address condition are not described as affected.
What does an attacker need to exploit this?
An attacker only needs to send unauthenticated invalid requests remotely to the SMS webhook. They do not need Twilio callback signatures, credentials, or user interaction.
What is the practical impact of a successful attack?
The attacker can consume the shared pre-authentication rate-limit budget, causing correctly signed Twilio callbacks to receive HTTP 429 responses until the rate-limit window resets. This results in temporary inbound SMS loss; it does not allow callback forgery or access to message data.
What should be done to remediate the issue?
Upgrade OpenClaw to version 2026.8.1, which fixes the issue.