Is CVE-2026-28478 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28478 being exploited in the wild.

How severe is CVE-2026-28478?

Low severity, with a CVSS score of 3.1, published 18 February 2026.

Which products and versions are affected?

clawdbot (npm) SEMVER:introduced=0,last_affected=2026.1.24-3; Openclaw <2026.2.13.

Is there a fix for CVE-2026-28478?

A patch was published on 2026-02-18: Fix available in OpenClaw >=2026.2.13 and clawdbot >2026.1.24-3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28478 attacked?

It is attacked over the network.

Am I affected by CVE-2026-28478?

Check whether you run clawdbot (npm) or Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28478: OpenClaw denial of service via unbounded webhook request body buffering

Q: Is there a fix for CVE-2026-28478?

A patch was published on 2026-02-18: Fix available in OpenClaw >=2026.2.13 and clawdbot >2026.1.24-3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-28478 · Severity: low · CVSS 3.1 · Published 2026-02-18

OpenClaw is an AI agent platform that handles integrations with multiple messaging and collaboration services. Multiple webhook handlers in the system accepted and buffered incoming request bodies without enforcing size or time limits, allowing remote attackers to send oversized payloads that consume server memory and degrade service availability for all users.

Technologies: clawdbot (npm), Openclaw. Vendors: npm, Openclaw.

Quick answers

Is CVE-2026-28478 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28478 being exploited in the wild.
How severe is CVE-2026-28478?: Low severity, with a CVSS score of 3.1, published 18 February 2026.
Which products and versions are affected?: clawdbot (npm) SEMVER:introduced=0,last_affected=2026.1.24-3; Openclaw <2026.2.13.
Is there a fix for CVE-2026-28478?: A patch was published on 2026-02-18: Fix available in OpenClaw >=2026.2.13 and clawdbot >2026.1.24-3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28478 attacked?: It is attacked over the network.
Am I affected by CVE-2026-28478?: Check whether you run clawdbot (npm) or Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is an uncontrolled resource consumption issue (CWE-400) in webhook request handling. Multiple webhook code paths buffered HTTP request bodies without consistent maxBytes and timeoutMs enforcement; some SDK-backed handlers parsed request bodies internally without stream-level guards. A remote, unauthenticated attacker can exploit this by sending large JSON payloads or slow/incomplete uploads to webhook endpoints (e.g., LINE, Slack, Telegram, Nextcloud Talk, Google Chat, and others), causing elevated memory usage and request handler pressure that degrades availability. The fix introduced a shared bounded request-body helper in src/infra/http-body.ts with standardized responses (413 Payload Too Large, 408 Request Timeout) and applied it consistently across all affected webhook paths.

Affected products

OpenClaw OpenClaw <2026.2.13
OpenClaw clawdbot <=2026.1.24-3

Identifiers

CVE-2026-28478
GHSA-q447-rj3r-2cgh

Timeline

2026-02-18: disclosed: Advisory GHSA-q447-rj3r-2cgh published
2026-02-18: patched: Fix available in OpenClaw >=2026.2.13 and clawdbot >2026.1.24-3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.