CVE-2026-32011: OpenClaw pre-auth webhook DoS

CISO Take

OpenClaw's webhook handlers for BlueBubbles and Google Chat parse request bodies before performing any authentication or signature validation, allowing any unauthenticated attacker on the internet to exhaust parser resources with slow or oversized payloads. With an EPSS placing this in the top 67th percentile of exploitation likelihood and a CVSS vector of AV:N/AC:L/PR:N/UI:N, the attack requires zero credentials and zero user interaction — making it trivially automatable against any internet-exposed OpenClaw webhook endpoint. There is no public exploit or CISA KEV designation at this time, and only 4 downstream dependents limit the blast radius beyond direct deployers, but OpenClaw's track record of 396 prior CVEs signals systemic security debt warranting prioritized patching. Upgrade to OpenClaw 2026.3.2 immediately; if patching is blocked, enforce maximum request body size limits and connection read timeouts at the API gateway or WAF layer before traffic reaches the application.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

CVSS 7.5 High with AV:N/AC:L/PR:N/UI:N makes this trivially exploitable from the internet with no setup required. The blast radius is confined to availability (C:N/I:N/A:H), but for AI agent deployments where webhook-triggered automation is operationally critical, sustained DoS translates directly to business process failure. EPSS at 0.00418 placing this in the top 67th percentile elevates the exploitation likelihood estimate above the median CVE. OpenClaw's history of 396 prior CVEs is a significant signal of systemic security debt. Low downstream dependent count (4) limits second-order exposure but does not reduce direct deployer risk.

How does the attack unfold?

Reconnaissance

Attacker scans for publicly exposed OpenClaw instances by targeting default webhook URL paths discoverable from the open-source repository.

AML.T0006

Exploitation

Attacker sends slow or oversized HTTP POST request bodies to the BlueBubbles or Google Chat webhook endpoint, exploiting the pre-authentication body parsing flaw.

AML.T0049

Resource Exhaustion

Parser threads and memory are consumed processing malicious payloads before signature validation can reject them, sustaining resource drain with minimal attacker overhead.

AML.T0034.001

Service Disruption

AI agent service becomes unavailable, blocking all webhook-triggered workflows and messaging platform integrations for legitimate users.

AML.T0029

Reconnaissance

Attacker scans for publicly exposed OpenClaw instances by targeting default webhook URL paths discoverable from the open-source repository.

AML.T0006

Exploitation

Attacker sends slow or oversized HTTP POST request bodies to the BlueBubbles or Google Chat webhook endpoint, exploiting the pre-authentication body parsing flaw.

AML.T0049

Resource Exhaustion

Parser threads and memory are consumed processing malicious payloads before signature validation can reject them, sustaining resource drain with minimal attacker overhead.

AML.T0034.001

Service Disruption

AI agent service becomes unavailable, blocking all webhook-triggered workflows and messaging platform integrations for legitimate users.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

5 steps

Upgrade OpenClaw to version 2026.3.2 or later (patch commit: d3e8b17aa6432536806b4853edc7939d891d0f25).
If patching is not immediately possible, enforce maximum request body size limits (e.g., 1 MB) and connection read timeouts (e.g., 10 seconds) at the reverse proxy or WAF before traffic reaches OpenClaw webhook handlers.
Restrict webhook endpoint access to known source IP ranges — BlueBubbles server IPs and Google Chat infrastructure IPs (published by Google).
Apply rate limiting on webhook paths to reduce attacker throughput.
Monitor for anomalous slow POST requests or unusually large payloads to webhook paths as indicators of active exploitation.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Agent AML.T0029 - Denial of AI Service AML.T0034.001 - Resource-Intensive Queries AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system lifecycle management

NIST AI RMF

MANAGE 2.2 - Mechanisms to respond to AI risks

OWASP LLM Top 10

LLM10:2025 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-32011?

OpenClaw's webhook handlers for BlueBubbles and Google Chat parse request bodies before performing any authentication or signature validation, allowing any unauthenticated attacker on the internet to exhaust parser resources with slow or oversized payloads. With an EPSS placing this in the top 67th percentile of exploitation likelihood and a CVSS vector of AV:N/AC:L/PR:N/UI:N, the attack requires zero credentials and zero user interaction — making it trivially automatable against any internet-exposed OpenClaw webhook endpoint. There is no public exploit or CISA KEV designation at this time, and only 4 downstream dependents limit the blast radius beyond direct deployers, but OpenClaw's track record of 396 prior CVEs signals systemic security debt warranting prioritized patching. Upgrade to OpenClaw 2026.3.2 immediately; if patching is blocked, enforce maximum request body size limits and connection read timeouts at the API gateway or WAF layer before traffic reaches the application.

Is CVE-2026-32011 actively exploited?

No confirmed active exploitation of CVE-2026-32011 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32011?

1. Upgrade OpenClaw to version 2026.3.2 or later (patch commit: d3e8b17aa6432536806b4853edc7939d891d0f25). 2. If patching is not immediately possible, enforce maximum request body size limits (e.g., 1 MB) and connection read timeouts (e.g., 10 seconds) at the reverse proxy or WAF before traffic reaches OpenClaw webhook handlers. 3. Restrict webhook endpoint access to known source IP ranges — BlueBubbles server IPs and Google Chat infrastructure IPs (published by Google). 4. Apply rate limiting on webhook paths to reduce attacker throughput. 5. Monitor for anomalous slow POST requests or unusually large payloads to webhook paths as indicators of active exploitation.

What systems are affected by CVE-2026-32011?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent pipelines, webhook integrations.

What is the CVSS score for CVE-2026-32011?

CVE-2026-32011 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.42%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent pipelineswebhook integrations

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0034.001 Resource-Intensive Queries

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM10:2025

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.3.2 contain a denial of service vulnerability in webhook handlers for BlueBubbles and Google Chat that parse request bodies before performing authentication and signature validation. Unauthenticated attackers can exploit this by sending slow or oversized request bodies to exhaust parser resources and degrade service availability.

Exploitation Scenario

An attacker scans internet-facing hosts for OpenClaw deployments by targeting default webhook URL paths discoverable from the public repository. They craft HTTP POST requests against the BlueBubbles or Google Chat webhook endpoints using either a Slowloris-style technique (transmitting the request body one byte at a time to hold parser threads open) or by sending bursts of multi-megabyte payloads. Because OpenClaw parses the full request body before checking authentication or validating message signatures, each malicious connection ties up a parser thread and memory allocation until completion or timeout. Sustaining a modest volume of concurrent slow or oversized requests exhausts the available thread pool and memory budget, rendering the AI agent unavailable for all legitimate webhook-triggered workflows without ever needing a valid credential or API token.

Weaknesses (CWE)

CWE-770 Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.