Vulnerabilities

TI-2026-26757 CVE-2026-34505 · GHSA-5m9r-p9g7-679c

OpenClaw < 2026.3.12 - Webhook Rate Limiting Bypass via Pre-Authentication Secret Validation

LOW 38

OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00277 Published 2026-03-31 Fixed in 2026.3.12 CWE-307

TI-2026-25368 CVE-2026-32920 · GHSA-99qw-6mr3-36qr

OpenClaw < 2026.3.12 - Arbitrary Code Execution via Auto-Discovery of Workspace Plugins

LOW 39

OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code execution.

CVSS 4.0HIGH 8.6 Local No auth No interaction EPSS 0.00336 Published 2026-03-31 Fixed in 2026.3.12 CWE-829

Vulnerabilities

Filters

OpenClaw < 2026.3.12 - Webhook Rate Limiting Bypass via Pre-Authentication Secret Validation

OpenClaw < 2026.3.12 - Arbitrary Code Execution via Auto-Discovery of Workspace Plugins