CVE-2026-32980: OpenClaw unauthenticated webhook DoS

CISO Take

OpenClaw's Telegram webhook handler reads and fully parses incoming request bodies before validating the authentication secret header, allowing any unauthenticated attacker to exhaust server memory, sockets, and CPU by flooding the endpoint with large or rapid-fire POST requests. With network-accessible exploitation requiring zero credentials or user interaction (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), this is a trivially exploitable availability risk against any deployment with a public-facing webhook. Although EPSS sits at 0.53% (top 59th percentile) and no public exploit or CISA KEV listing exists, the fix-before-validate anti-pattern is well-understood and attackable with commodity HTTP tools. Upgrade to OpenClaw 2026.3.13 immediately; as a workaround, enforce rate limiting and maximum body size at a reverse proxy layer before requests reach the application.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium risk overall. The vulnerability is trivially exploitable — no authentication, no complexity, no special tooling required — and directly targets availability with a High CVSS impact score. However, the blast radius is limited: impact is confined to denial-of-service with no confidentiality or integrity exposure, EPSS at 0.53% signals low observed exploitation activity, and the package reports only 4 downstream dependents. The absence from CISA KEV further supports limited active exploitation in the wild. Organizations running OpenClaw in production with publicly accessible Telegram webhooks carry the most direct exposure, particularly if the agent underpins event-driven automation or customer-facing AI workflows where uptime is operationally critical.

How does the attack unfold?

Reconnaissance

Attacker identifies the target's public OpenClaw Telegram webhook URL via Telegram bot API enumeration or passive recon of public bot registrations.

AML.T0006

Initial Access

Attacker sends unauthenticated POST requests directly to the webhook endpoint — no credentials, tokens, or prior access required to trigger the vulnerable code path.

AML.T0049

Resource Exhaustion

Server allocates memory buffers, holds sockets open, and executes full JSON parsing for each request before checking the x-telegram-bot-api-secret-token header, driving memory and CPU toward saturation under sustained flood.

AML.T0034.000

Impact: Service Disruption

OpenClaw agent becomes unresponsive or crashes, dropping all legitimate Telegram events and halting dependent AI agent workflows and automation pipelines.

AML.T0029

Reconnaissance

Attacker identifies the target's public OpenClaw Telegram webhook URL via Telegram bot API enumeration or passive recon of public bot registrations.

AML.T0006

Initial Access

Attacker sends unauthenticated POST requests directly to the webhook endpoint — no credentials, tokens, or prior access required to trigger the vulnerable code path.

AML.T0049

Resource Exhaustion

Server allocates memory buffers, holds sockets open, and executes full JSON parsing for each request before checking the x-telegram-bot-api-secret-token header, driving memory and CPU toward saturation under sustained flood.

AML.T0034.000

Impact: Service Disruption

OpenClaw agent becomes unresponsive or crashes, dropping all legitimate Telegram events and halting dependent AI agent workflows and automation pipelines.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

5 steps

Patch: Upgrade OpenClaw to 2026.3.13 or later — commit 7e49e98 reorders the handler to validate the x-telegram-bot-api-secret-token header before allocating memory or reading the request body.
Immediate workaround: Configure a reverse proxy (nginx, Caddy, Cloudflare) to enforce strict per-IP rate limits (e.g., 10 req/s) on the webhook path and cap maximum request body size (e.g., 1 MB) before forwarding to OpenClaw.
Network segmentation: Restrict webhook endpoint access to Telegram's published IP ranges where firewall policy permits.
Detection: Alert on sustained spikes in memory usage, HTTP 503/timeout rates, or elevated request rates from single source IPs on the webhook endpoint.
Verification: Post-patch, confirm fix by reviewing commit 7e49e98 — the authentication check must precede all I/O reads on the request body.

How is it classified?

DoS Agent AML.T0029 - Denial of AI Service AML.T0034.000 - Excessive Queries AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

8.4 - AI system risk assessment

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain the value of deployed AI systems are evaluated and applied

OWASP LLM Top 10

LLM10 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-32980?

OpenClaw's Telegram webhook handler reads and fully parses incoming request bodies before validating the authentication secret header, allowing any unauthenticated attacker to exhaust server memory, sockets, and CPU by flooding the endpoint with large or rapid-fire POST requests. With network-accessible exploitation requiring zero credentials or user interaction (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), this is a trivially exploitable availability risk against any deployment with a public-facing webhook. Although EPSS sits at 0.53% (top 59th percentile) and no public exploit or CISA KEV listing exists, the fix-before-validate anti-pattern is well-understood and attackable with commodity HTTP tools. Upgrade to OpenClaw 2026.3.13 immediately; as a workaround, enforce rate limiting and maximum body size at a reverse proxy layer before requests reach the application.

Is CVE-2026-32980 actively exploited?

No confirmed active exploitation of CVE-2026-32980 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32980?

1. Patch: Upgrade OpenClaw to 2026.3.13 or later — commit 7e49e98 reorders the handler to validate the x-telegram-bot-api-secret-token header before allocating memory or reading the request body. 2. Immediate workaround: Configure a reverse proxy (nginx, Caddy, Cloudflare) to enforce strict per-IP rate limits (e.g., 10 req/s) on the webhook path and cap maximum request body size (e.g., 1 MB) before forwarding to OpenClaw. 3. Network segmentation: Restrict webhook endpoint access to Telegram's published IP ranges where firewall policy permits. 4. Detection: Alert on sustained spikes in memory usage, HTTP 503/timeout rates, or elevated request rates from single source IPs on the webhook endpoint. 5. Verification: Post-patch, confirm fix by reviewing commit 7e49e98 — the authentication check must precede all I/O reads on the request body.

What systems are affected by CVE-2026-32980?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI chatbots and assistants, event-driven AI pipelines.

What is the CVSS score for CVE-2026-32980?

CVE-2026-32980 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.53%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI chatbots and assistantsevent-driven AI pipelines

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0034.000 Excessive Queries

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 8.4

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests to the webhook endpoint to force memory consumption, socket time, and JSON parsing work before authentication validation occurs.

Exploitation Scenario

An attacker discovers a target organization's OpenClaw Telegram bot via public Telegram API enumeration or passive reconnaissance of bot registrations. Using a simple script or curl loop, the attacker floods the webhook POST endpoint with large (e.g., 50MB) or high-frequency requests containing arbitrary JSON payloads. Each request causes the server to allocate memory buffers, hold open socket connections, and invoke the JSON parser before OpenClaw checks the x-telegram-bot-api-secret-token header. Within minutes, available server memory is exhausted or socket limits are breached, causing the AI agent to stop processing legitimate Telegram messages, drop events, and potentially crash. No knowledge of the secret token, no account, and no specialized tooling are required — any HTTP flooding utility suffices.

Weaknesses (CWE)

CWE-770 Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.