Executive brief
OpenClaw is a popular deployment and automation platform that uses webhooks to trigger remote actions. An unauthenticated attacker can send repeated invalid requests using unsupported HTTP methods (like GET) to exhaust the webhook authentication failure budget, temporarily disabling legitimate webhook delivery for other users sharing the same network path (e.g., behind a shared proxy). The impact is limited to brief service interruptions for webhook-based automation rather than data exposure.
Technical details
The vulnerability is an improper authentication rate-limiting implementation (CWE-307, CWE-799). OpenClaw's /hooks/* HTTP handler counted authentication failures before validating the HTTP method, allowing non-POST requests to increment the auth failure counter even though they should be rejected immediately with a 405 Method Not Allowed response. An unauthenticated, network-reachable attacker can exploit this by sending repeated GET requests with invalid tokens to the hooks endpoint, consuming the auth failure budget and triggering a temporary lockout for the client key. This is particularly effective in NAT or shared proxy environments where multiple legitimate users share the same source IP. The fix (version 2026.3.7+) reorders the validation logic to check HTTP method support before attempting authentication, preventing unsupported methods from affecting the rate limiter.
Affected products
- OpenClaw openclaw <= 2026.3.2
Timeline
- 2026-03-09: disclosed
- 2026-03-08: patched: Version 2026.3.7 published on npm