Vulnerability DatabaseCVE-2026-35623
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-35623
Published:April 09, 2026
Updated:April 20, 2026
OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in webhook authentication that allows attackers to brute-force weak webhook passwords without throttling. Remote attackers can repeatedly submit incorrect password guesses to the webhook endpoint to compromise authentication and gain unauthorized access.
Affected Packages
https://github.com/openclaw/openclaw.git (GITHUB):
Affected version(s) >=v0.1.0 <2026.3.25
Fix Suggestion:
Update to version 2026.3.25
openclaw (NPM):
Affected version(s) >=0.0.1 <2026.3.25
Fix Suggestion:
Update to version 2026.3.25
Related Resources (5)
https://nvd.nist.gov/vuln/detail/CVE-2026-35623
https://github.com/openclaw/openclaw/commit/5e08ce36d522a1c96df2bfe88e39303ae2643d92
https://github.com/openclaw/openclaw
https://github.com/openclaw/openclaw/security/advisories/GHSA-xq8g-hgh6-87hv
https://www.vulncheck.com/advisories/openclaw-brute-force-attack-via-missing-webhook-password-rate-limiting
Do you need more information?
Contact Us
CVSS v4
Base Score:
6.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
4.8
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Weak Password Requirements
CWE-521
Improper Restriction of Excessive Authentication Attempts
CWE-307
EPSS
Base Score:
0.05