CVE-2026-34505: OpenClaw < 2026.3.12 - Webhook Rate Limiting Bypass via Pre-Authentication Secret Validation
OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets without triggering rate limit responses, enabling systematic secret guessing and subsequent forged webhook submission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.3.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34505?
CVE-2026-34505 is rated as a high-severity vulnerability due to its potential for abuse in bypassing webhook rate limits.
How do I fix CVE-2026-34505?
To fix CVE-2026-34505, update OpenClaw to version 2026.3.12 or later where the issue has been addressed.
What does CVE-2026-34505 exploit?
CVE-2026-34505 exploits a weakness in the rate limiting mechanism, allowing pre-authentication secret validation to be bypassed.
Who is affected by CVE-2026-34505?
CVE-2026-34505 affects all versions of OpenClaw prior to 2026.3.12.
What kind of attacks can CVE-2026-34505 facilitate?
CVE-2026-34505 can facilitate brute-force attacks against webhook secrets due to its lack of pre-authentication rate limiting.