Executive brief
OpenClaw, a gateway and tool integration platform, contains a flaw where security protections meant to limit the speed of login attempts can be bypassed. An attacker could exploit this to flood the system with authentication requests, potentially overwhelming the server's resources. This can lead to service slowdowns or outages for legitimate users.
Technical details
A vulnerability in OpenClaw (specifically the npm package) allows a remote attacker to bypass non-browser rate limits during WebSocket authentication. The root cause is an improper restriction of excessive authentication attempts (CWE-307) and uncontrolled resource consumption (CWE-400). By sending a high volume of authentication requests through a configured input path or lower-trust caller, an attacker can consume gateway resources, leading to a denial-of-service (DoS) condition. The vulnerability is reachable over the network without prior authentication. The issue is resolved in version 2026.5.26.
Affected products
- OpenClaw OpenClaw >= 2026.2.25, < 2026.5.26
Timeline
- 2026-06-30: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: NVD and VulnCheck publication
- 2026-05-26: patched: First stable patched version released