OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing

TRUNG BÌNH 6.5CVE-2026-35623 · GHSA-xq8g-hgh6-87hv · Công bố 09/04/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-35623 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng openclaw (openclaw), openclaw.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.36%, cao hơn 30.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2026.3.25 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
openclaw openclaw	`< 2026.3.25`	`2026.3.25`
openclaw npm	`≤ 2026.3.24`	Chưa có bản vá

Mô tả

Summary

BlueBubbles Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Password

Affected Packages / Versions

Package: openclaw
Affected versions: <= 2026.3.24
First patched version: 2026.3.25
Latest published npm version at verification time: 2026.3.24

Details

BlueBubbles webhook auth previously rejected wrong passwords without throttling repeated guesses, allowing brute-force attempts against weak webhook passwords. Commit 5e08ce36d522a1c96df2bfe88e39303ae2643d92 adds repeated-guess throttling before auth failure responses.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 5e08ce36d522a1c96df2bfe88e39303ae2643d92.

Fix Commit(s)

5e08ce36d522a1c96df2bfe88e39303ae2643d92

Mô tả của NVD

OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in webhook authentication that allows attackers to brute-force weak webhook passwords without throttling. Remote attackers can repeatedly submit incorrect password guesses to the webhook endpoint to compromise authentication and gain unauthorized access.