Executive brief
OpenClaw is an open-source tool used for managing webhooks, specifically for BlueBubbles integration. A security flaw in its webhook authentication allows attackers to repeatedly guess passwords without being blocked or slowed down. This could lead to unauthorized access to the webhook endpoint, potentially compromising data or system operations if weak passwords are used.
Technical details
A missing rate limiting vulnerability (CWE-307) exists in OpenClaw versions prior to 2026.3.25. The BlueBubbles webhook authentication component fails to throttle repeated failed login attempts, enabling remote attackers to conduct brute-force attacks against webhook passwords. While the attack complexity is rated as high (likely due to the need for a weak password or specific configuration), a successful exploit allows unauthorized access to the webhook endpoint. The issue was addressed by implementing request throttling based on client IP addresses in commit 5e08ce3.
Affected products
- OpenClaw openclaw <= 2026.3.24
Timeline
- 2026-03-26: patched: Fix committed to main branch
- 2026-04-09: advisory: NVD published CVE-2026-35623
- 2026-04-10: disclosed: Initial GitHub Advisory published
- 2026-04-18: other: Advisory withdrawn as a duplicate of GHSA-xq8g-hgh6-87hv