CVE-2026-28461: OpenClaw webhook DoS

CISO Take

OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth flaw in the Zalo webhook endpoint that any unauthenticated remote attacker can exploit by sending repeated requests with unique query parameters, causing continuous in-memory key accumulation until the process becomes unstable or crashes. With zero authentication required, low attack complexity, and an EPSS placing this in the 73rd percentile of CVEs most likely to see exploitation, opportunistic targeting of internet-exposed OpenClaw deployments is a realistic near-term threat. The vulnerability is availability-only — no confidentiality or integrity impact — but a downed AI agent service can cascade into complete operational disruption for AI-driven workflows dependent on the platform. Remediate by upgrading to OpenClaw 2026.3.1 immediately; in the interim, restrict network access to the Zalo webhook endpoint and enforce rate limiting at the perimeter.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

High severity DoS with a favorable attacker profile: no credentials, no user interaction, network-reachable attack surface with low complexity. The EPSS of 0.00354 (73rd percentile) reflects meaningfully elevated exploitation probability relative to the average CVE despite no public exploit or scanner template being available yet. The impact is scoped exclusively to availability, which limits the blast radius compared to RCE or data-exfiltration vulnerabilities. However, the package carries a history of 396 prior CVEs and a zero OpenSSF Scorecard rating, signaling a chronically weak security posture that warrants heightened scrutiny. Organizations with internet-exposed OpenClaw instances in production AI agent workflows face the greatest immediate risk; network-segmented deployments reduce exposure substantially.

How does the attack unfold?

Reconnaissance

Attacker identifies an internet-exposed OpenClaw instance and locates the Zalo webhook endpoint path via public documentation, source code, or application fingerprinting.

AML.T0006

Exploitation

Attacker sends a high-volume stream of HTTP requests to the Zalo webhook endpoint, each bearing a unique query parameter key, triggering unbounded in-memory key allocation within the OpenClaw process.

AML.T0049

Resource Exhaustion

Heap memory grows continuously with each unique key; without eviction or limits, the process consumes available system memory until OOM conditions are reached and performance degrades severely.

AML.T0034.000

Impact

OpenClaw service crashes or becomes unresponsive, halting all AI agent tasks and orchestration workflows on the instance and denying service to legitimate users and dependent systems.

AML.T0029

Reconnaissance

Attacker identifies an internet-exposed OpenClaw instance and locates the Zalo webhook endpoint path via public documentation, source code, or application fingerprinting.

AML.T0006

Exploitation

Attacker sends a high-volume stream of HTTP requests to the Zalo webhook endpoint, each bearing a unique query parameter key, triggering unbounded in-memory key allocation within the OpenClaw process.

AML.T0049

Resource Exhaustion

Heap memory grows continuously with each unique key; without eviction or limits, the process consumes available system memory until OOM conditions are reached and performance degrades severely.

AML.T0034.000

Impact

OpenClaw service crashes or becomes unresponsive, halting all AI agent tasks and orchestration workflows on the instance and denying service to legitimate users and dependent systems.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 28% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

5 steps

Patch: Upgrade OpenClaw to version 2026.3.1 or later immediately per the vendor advisory.
Interim workaround: Block or rate-limit external access to the Zalo webhook endpoint at the WAF or reverse proxy layer; if Zalo IPs are known, restrict to those ranges exclusively.
Disable: If the Zalo webhook integration is not actively used, disable it at the application configuration level to eliminate the attack surface entirely.
Detection: Monitor OpenClaw process memory consumption with alerts on sustained growth exceeding 50% above baseline over any 5-minute window; sudden OOM events on webhook-serving processes should trigger incident response.
Audit: Confirm whether the Zalo webhook endpoint is internet-accessible or restricted to internal networks — prioritize patching internet-exposed instances first.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Agent AML.T0029 - Denial of AI Service AML.T0034.000 - Excessive Queries AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.5 - AI system security

NIST AI RMF

MANAGE-2.2 - Mechanisms are in place and processes are followed with respect to reversing or stopping deployment or use of the AI system

OWASP LLM Top 10

LLM10 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-28461?

OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth flaw in the Zalo webhook endpoint that any unauthenticated remote attacker can exploit by sending repeated requests with unique query parameters, causing continuous in-memory key accumulation until the process becomes unstable or crashes. With zero authentication required, low attack complexity, and an EPSS placing this in the 73rd percentile of CVEs most likely to see exploitation, opportunistic targeting of internet-exposed OpenClaw deployments is a realistic near-term threat. The vulnerability is availability-only — no confidentiality or integrity impact — but a downed AI agent service can cascade into complete operational disruption for AI-driven workflows dependent on the platform. Remediate by upgrading to OpenClaw 2026.3.1 immediately; in the interim, restrict network access to the Zalo webhook endpoint and enforce rate limiting at the perimeter.

Is CVE-2026-28461 actively exploited?

No confirmed active exploitation of CVE-2026-28461 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-28461?

1. Patch: Upgrade OpenClaw to version 2026.3.1 or later immediately per the vendor advisory. 2. Interim workaround: Block or rate-limit external access to the Zalo webhook endpoint at the WAF or reverse proxy layer; if Zalo IPs are known, restrict to those ranges exclusively. 3. Disable: If the Zalo webhook integration is not actively used, disable it at the application configuration level to eliminate the attack surface entirely. 4. Detection: Monitor OpenClaw process memory consumption with alerts on sustained growth exceeding 50% above baseline over any 5-minute window; sudden OOM events on webhook-serving processes should trigger incident response. 5. Audit: Confirm whether the Zalo webhook endpoint is internet-accessible or restricted to internal networks — prioritize patching internet-exposed instances first.

What systems are affected by CVE-2026-28461?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent orchestration platforms, webhook-integrated AI pipelines.

What is the CVSS score for CVE-2026-28461?

CVE-2026-28461 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.35%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent orchestration platformswebhook-integrated AI pipelines

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0034.000 Excessive Queries

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.5

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger in-memory key accumulation by varying query strings. Remote attackers can exploit this by sending repeated requests with different query parameters to cause memory pressure, process instability, or out-of-memory conditions that degrade service availability.

Exploitation Scenario

An adversary scans for internet-exposed OpenClaw instances and identifies the Zalo webhook endpoint via public documentation or fingerprinting. They deploy an automated script that generates thousands of HTTP requests to the endpoint per minute, each with a novel query parameter key (e.g., ?uid_1=x, ?uid_2=y ... ?uid_N=z). Each unique key is allocated in the process heap and never evicted. Over minutes, the OpenClaw process memory grows continuously until the OS OOM killer terminates it or the host becomes severely resource-constrained. In an AI agent deployment, this halts all agent tasks — potentially including security monitoring, workflow automation, or customer-facing AI services — achieving targeted denial of service with minimal attacker resources and no authentication.

Weaknesses (CWE)

CWE-770 Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.