En bref
- CVE-2026-35623 est une vulnérabilité MOYENNE (CVSS 6.5) touchant openclaw (openclaw), openclaw.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.36%, plus élevée que 30.0% des vulnérabilités.
- Correctif : mettre à jour vers 2026.3.25 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.25
| 2026.3.25
|
| openclaw npm | ≤ 2026.3.24
| No fix yet |
Description
Summary
BlueBubbles Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Password
Affected Packages / Versions
- Package:
openclaw
- Affected versions:
<= 2026.3.24
- First patched version:
2026.3.25
- Latest published npm version at verification time:
2026.3.24
Details
BlueBubbles webhook auth previously rejected wrong passwords without throttling repeated guesses, allowing brute-force attempts against weak webhook passwords. Commit 5e08ce36d522a1c96df2bfe88e39303ae2643d92 adds repeated-guess throttling before auth failure responses.
Verified vulnerable on tag v2026.3.24 and fixed on main by commit 5e08ce36d522a1c96df2bfe88e39303ae2643d92.
Fix Commit(s)
5e08ce36d522a1c96df2bfe88e39303ae2643d92
NVD description
OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in webhook authentication that allows attackers to brute-force weak webhook passwords without throttling. Remote attackers can repeatedly submit incorrect password guesses to the webhook endpoint to compromise authentication and gain unauthorized access.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free