Executive brief
OpenClaw is a Node.js library that handles webhooks from LINE (a popular messaging platform). The webhook handler lacks rate limiting on unauthenticated requests before validating the request signature, allowing attackers to send a high volume of requests and temporarily exhaust server resources, causing brief service disruptions. The impact is limited to temporary unavailability and does not expose data or compromise security.
Technical details
The vulnerability stems from a missing shared pre-authentication concurrency budget (rate limit) on the public LINE webhook endpoint. Attackers can send a flood of webhook requests without authentication, causing resource exhaustion before signature verification occurs. The attack vector is network-based and requires no authentication or user interaction. While the vulnerability allows denial of service, the advisory notes the effect is bounded to transient availability loss. The fix was released in version 2026.3.31, which adds concurrency budgeting on the unauthenticated webhook path.
Affected products
- OpenClaw OpenClaw <=2026.3.28
Timeline
- 2026-04-02: disclosed
- 2026-03-31: patched: Fix released in version 2026.3.31