Vulnerabilities

TI-2026-25435 CVE-2026-32987 · GHSA-hwmr-xj5r-936p

OpenClaw < 2026.3.13 - Bootstrap Setup Code Replay via Device Pairing

MEDIUM 48

OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00357 Published 2026-03-29 Fixed in 2026.3.13 CWE-294

TI-2026-25428 CVE-2026-32980 · GHSA-jq3f-vjww-8rq7

OpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook Request

LOW 38

OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00541 Published 2026-03-29 Fixed in 2026.3.13 CWE-770

Vulnerabilities

Filters

OpenClaw < 2026.3.13 - Bootstrap Setup Code Replay via Device Pairing

OpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook Request