CVE-2026-35623: OpenClaw Brute-force auth bypass

CISO Take

OpenClaw before 2026.3.25 lacks rate limiting on its webhook authentication endpoint, allowing any remote attacker to systematically brute-force weak webhook passwords without throttling or lockout. While CVSS rates Attack Complexity as High, the practical barrier is low—no prior credentials or privileged position are required, and with CWE-307 as the root cause any scripted tool can automate thousands of guesses per minute against the endpoint unimpeded. A successful breach grants authenticated access to the agent's webhook interface, potentially enabling injection of arbitrary commands into AI agent workflows, exfiltration of data processed by connected tools, or full hijacking of automated pipelines. The OpenClaw ecosystem carries compounding documented risk (AIID #1368: malicious third-party skills delivering credential stealers to 17% of users), making hardening webhook authentication an urgent control rather than a deferred patch. Upgrade to 2026.3.25 immediately, rotate all webhook secrets with cryptographically strong values, and enforce external rate limiting at the reverse proxy or WAF layer pending the update.

Sources: NVD EPSS GitHub Advisory ATLAS AIID

What is the risk?

CVSS 4.8 (medium) accurately reflects constrained scope (C:L, I:L) and High attack complexity, but the absence of any throttling mechanism means the only real-world barrier is password strength—a control organizations rarely audit on AI agent integrations. EPSS of 0.36% (top 72nd percentile) indicates statistically moderate exploitation likelihood relative to all CVEs. No public exploits or Nuclei templates are available and the CVE is not in CISA KEV, keeping near-term mass exploitation risk low. However, 396 prior CVEs in the same package signal persistent security debt, and webhook compromise of an AI agent produces disproportionate downstream impact in agentic pipelines that exceeds what the vector score suggests for traditional software.

How does the attack unfold?

Reconnaissance

Adversary identifies a publicly exposed OpenClaw instance with an accessible webhook authentication endpoint via passive scanning or GitHub searches for configuration files containing webhook URLs.

AML.T0006

Brute-Force Authentication

Automated credential stuffing scripts submit repeated password guesses against the webhook endpoint; the absence of rate limiting (CWE-307) allows thousands of attempts per minute without throttling or lockout.

AML.T0049

Webhook Access Gained

A weak or reused password is discovered and the attacker authenticates to the webhook, obtaining the same trust level as any legitimate integration without triggering any defensive alert.

AML.T0012

Agent Hijacking and Data Exfiltration

The attacker injects malicious task payloads via the authenticated webhook, redirecting AI agent actions to exfiltrate data, disrupt automated pipelines, or invoke connected tools to pivot to downstream systems.

AML.T0053

Reconnaissance

Adversary identifies a publicly exposed OpenClaw instance with an accessible webhook authentication endpoint via passive scanning or GitHub searches for configuration files containing webhook URLs.

AML.T0006

Brute-Force Authentication

Automated credential stuffing scripts submit repeated password guesses against the webhook endpoint; the absence of rate limiting (CWE-307) allows thousands of attempts per minute without throttling or lockout.

AML.T0049

Webhook Access Gained

A weak or reused password is discovered and the attacker authenticates to the webhook, obtaining the same trust level as any legitimate integration without triggering any defensive alert.

AML.T0012

Agent Hijacking and Data Exfiltration

The attacker injects malicious task payloads via the authenticated webhook, redirecting AI agent actions to exfiltrate data, disrupt automated pipelines, or invoke connected tools to pivot to downstream systems.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

4.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C Low

I Low

A None

What should I do?

5 steps

Upgrade to OpenClaw >= 2026.3.25 (patch commit 5e08ce36d522a1c96df2bfe88e39303ae2643d92).
Immediately rotate all existing webhook secrets with cryptographically strong random values (minimum 32 bytes entropy).
Enforce rate limiting externally via reverse proxy (e.g., nginx limit_req_zone) or WAF rules targeting the webhook authentication endpoint if patching is delayed.
Audit webhook access logs for patterns of repeated failed authentication attempts indicating active brute-force campaigns.
If immediate patching is not possible, restrict webhook endpoint access to allowlisted source IP ranges or disable the endpoint until the upgrade is applied.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9(2) - Risk management system

ISO 42001

8.3 - AI risk treatment

NIST AI RMF

GOVERN-6.2 - Organizational risk policies include AI-specific security controls

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-35623?

OpenClaw before 2026.3.25 lacks rate limiting on its webhook authentication endpoint, allowing any remote attacker to systematically brute-force weak webhook passwords without throttling or lockout. While CVSS rates Attack Complexity as High, the practical barrier is low—no prior credentials or privileged position are required, and with CWE-307 as the root cause any scripted tool can automate thousands of guesses per minute against the endpoint unimpeded. A successful breach grants authenticated access to the agent's webhook interface, potentially enabling injection of arbitrary commands into AI agent workflows, exfiltration of data processed by connected tools, or full hijacking of automated pipelines. The OpenClaw ecosystem carries compounding documented risk (AIID #1368: malicious third-party skills delivering credential stealers to 17% of users), making hardening webhook authentication an urgent control rather than a deferred patch. Upgrade to 2026.3.25 immediately, rotate all webhook secrets with cryptographically strong values, and enforce external rate limiting at the reverse proxy or WAF layer pending the update.

Is CVE-2026-35623 actively exploited?

No confirmed active exploitation of CVE-2026-35623 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35623?

1. Upgrade to OpenClaw >= 2026.3.25 (patch commit 5e08ce36d522a1c96df2bfe88e39303ae2643d92). 2. Immediately rotate all existing webhook secrets with cryptographically strong random values (minimum 32 bytes entropy). 3. Enforce rate limiting externally via reverse proxy (e.g., nginx limit_req_zone) or WAF rules targeting the webhook authentication endpoint if patching is delayed. 4. Audit webhook access logs for patterns of repeated failed authentication attempts indicating active brute-force campaigns. 5. If immediate patching is not possible, restrict webhook endpoint access to allowlisted source IP ranges or disable the endpoint until the upgrade is applied.

What systems are affected by CVE-2026-35623?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Webhook integrations, Multi-agent pipelines, Agentic automation workflows.

What is the CVSS score for CVE-2026-35623?

CVE-2026-35623 has a CVSS v3.1 base score of 4.8 (MEDIUM). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksWebhook integrationsMulti-agent pipelinesAgentic automation workflows

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 9(2)

ISO 42001: 8.3

NIST AI RMF: GOVERN-6.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in webhook authentication that allows attackers to brute-force weak webhook passwords without throttling. Remote attackers can repeatedly submit incorrect password guesses to the webhook endpoint to compromise authentication and gain unauthorized access.

Exploitation Scenario

An adversary identifies a publicly exposed OpenClaw instance via passive reconnaissance—Shodan queries for OpenClaw service banners or GitHub searches for configuration files containing webhook URLs. With the target endpoint identified, they deploy an automated credential stuffing script using common weak passwords, default credentials, or values from prior data breach corpora. Because no rate limiting or lockout mechanism exists, thousands of guesses can be submitted per minute without interruption. Upon authentication success, the attacker submits crafted webhook payloads to inject malicious tasks into the OpenClaw agent's queue, leveraging the agent's existing tool access to exfiltrate data processed by the pipeline or pivot to connected internal systems—directly paralleling the credential-theft pattern documented in AIID #1368 against the same ecosystem.

Weaknesses (CWE)

CWE-307 Improper Restriction of Excessive Authentication Attempts

CWE-307 — Improper Restriction of Excessive Authentication Attempts: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

[Architecture and Design] Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

Source: MITRE CWE corpus.