CVE-2026-34505: OpenClaw webhook rate-limit bypass

CISO Take

OpenClaw before 2026.3.12 contains a logic flaw where rate limiting is enforced only after successful webhook authentication, allowing unauthenticated attackers to submit unlimited failed attempts and systematically brute-force webhook secrets over the network with no privileges or user interaction required. While the CVSS score is medium (6.5), the EPSS percentile places this in the top 81% of CVEs by exploitation likelihood, and the attack requires nothing beyond automated HTTP requests — making it trivially scriptable. A compromised webhook secret lets an attacker forge authenticated webhook submissions to the AI agent, potentially injecting malicious payloads into agent workflows or triggering unauthorized tool invocations; this attack path directly mirrors the mechanism behind AIID #1368, where OpenClaw's ecosystem was actively abused to deliver credential-stealing content. Upgrade immediately to OpenClaw >= 2026.3.12; as an interim control, deploy network-level rate limiting via WAF or reverse proxy in front of all webhook endpoints and rotate any secrets that may have been exposed.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium CVSS (6.5) understates operational risk: exploitation is trivial (CWE-307, zero privileges required, network-accessible), EPSS places this in the top 81% of CVEs by exploitation likelihood, and the attack chain directly targets AI agent webhook infrastructure. The 396 other CVEs in the same package signals a historically high-risk dependency. No public exploit or active exploitation confirmed yet, but the ease of automation — a simple HTTP loop with candidate secrets — means this could flip quickly. Webhook secrets controlling AI agent behavior represent a high-value target for adversaries seeking persistent, stealthy access to agentic pipelines.

How does the attack unfold?

Endpoint Discovery

Attacker identifies an exposed OpenClaw webhook endpoint via active network scanning or public API documentation enumeration.

AML.T0006

Rate-Limit Bypass

Attacker submits high-volume authentication requests with candidate secrets, exploiting the complete absence of pre-authentication rate limiting to avoid lockout.

AML.T0049

Secret Compromise

Attacker identifies the valid webhook secret and gains the ability to forge authenticated webhook submissions, effectively obtaining a valid credential for the agent interface.

AML.T0012

Agent Manipulation

Attacker submits forged webhook payloads containing malicious instructions or tool invocations, hijacking the AI agent's execution context within a trusted pipeline.

AML.T0080

Endpoint Discovery

Attacker identifies an exposed OpenClaw webhook endpoint via active network scanning or public API documentation enumeration.

AML.T0006

Rate-Limit Bypass

Attacker submits high-volume authentication requests with candidate secrets, exploiting the complete absence of pre-authentication rate limiting to avoid lockout.

AML.T0049

Secret Compromise

Attacker identifies the valid webhook secret and gains the ability to forge authenticated webhook submissions, effectively obtaining a valid credential for the agent interface.

AML.T0012

Agent Manipulation

Attacker submits forged webhook payloads containing malicious instructions or tool invocations, hijacking the AI agent's execution context within a trusted pipeline.

AML.T0080

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 19% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C Low

I Low

A None

What should I do?

5 steps

Patch: Upgrade OpenClaw to >= 2026.3.12 immediately.
Rotate all webhook secrets that have been exposed to internet-accessible endpoints.
Workaround (if immediate patching is blocked): deploy a WAF or reverse proxy implementing rate limiting on webhook authentication endpoints — cap failed auth attempts to 5-10 per IP per minute with exponential backoff.
Detection: Monitor webhook authentication logs for high-frequency failures from single or distributed IPs; alert on >20 failed attempts per minute per endpoint.
Network segmentation: restrict webhook endpoint access to known source IP ranges (CI/CD systems, integration partners) via firewall rules where feasible.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent AML.T0006 - Active Scanning AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0080 - AI Agent Context Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.9.2 - AI system technical robustness and security

NIST AI RMF

MANAGE-2.2 - Mechanisms to sustain and monitor AI risk treatments

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-34505?

OpenClaw before 2026.3.12 contains a logic flaw where rate limiting is enforced only after successful webhook authentication, allowing unauthenticated attackers to submit unlimited failed attempts and systematically brute-force webhook secrets over the network with no privileges or user interaction required. While the CVSS score is medium (6.5), the EPSS percentile places this in the top 81% of CVEs by exploitation likelihood, and the attack requires nothing beyond automated HTTP requests — making it trivially scriptable. A compromised webhook secret lets an attacker forge authenticated webhook submissions to the AI agent, potentially injecting malicious payloads into agent workflows or triggering unauthorized tool invocations; this attack path directly mirrors the mechanism behind AIID #1368, where OpenClaw's ecosystem was actively abused to deliver credential-stealing content. Upgrade immediately to OpenClaw >= 2026.3.12; as an interim control, deploy network-level rate limiting via WAF or reverse proxy in front of all webhook endpoints and rotate any secrets that may have been exposed.

Is CVE-2026-34505 actively exploited?

No confirmed active exploitation of CVE-2026-34505 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-34505?

1. Patch: Upgrade OpenClaw to >= 2026.3.12 immediately. 2. Rotate all webhook secrets that have been exposed to internet-accessible endpoints. 3. Workaround (if immediate patching is blocked): deploy a WAF or reverse proxy implementing rate limiting on webhook authentication endpoints — cap failed auth attempts to 5-10 per IP per minute with exponential backoff. 4. Detection: Monitor webhook authentication logs for high-frequency failures from single or distributed IPs; alert on >20 failed attempts per minute per endpoint. 5. Network segmentation: restrict webhook endpoint access to known source IP ranges (CI/CD systems, integration partners) via firewall rules where feasible.

What systems are affected by CVE-2026-34505?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent webhook integrations, event-driven AI pipelines.

What is the CVSS score for CVE-2026-34505?

CVE-2026-34505 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent webhook integrationsevent-driven AI pipelines

MITRE ATLAS Techniques

AML.T0006 Active Scanning

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0080 AI Agent Context Poisoning

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.9.2

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets without triggering rate limit responses, enabling systematic secret guessing and subsequent forged webhook submission.

Exploitation Scenario

An attacker discovers an internet-exposed OpenClaw webhook endpoint via passive DNS enumeration or public API documentation. They script a high-throughput brute-force loop — submitting thousands of HMAC or token-based authentication attempts per minute using candidate secrets — exploiting the complete absence of pre-authentication rate limiting to avoid any lockout or throttling response. Within minutes to hours depending on secret entropy, the valid webhook secret is identified. The attacker then crafts a forged webhook payload embedding a malicious tool invocation or prompt injection and submits it as a legitimate event. The AI agent processes the forged webhook within its trusted execution context, executing attacker-controlled instructions — potentially exfiltrating credentials, triggering lateral movement via connected tools, or poisoning downstream agent memory.

Weaknesses (CWE)

CWE-307 Improper Restriction of Excessive Authentication Attempts

CWE-307 — Improper Restriction of Excessive Authentication Attempts: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

[Architecture and Design] Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

Source: MITRE CWE corpus.