CVE-2026-35626: OpenClaw — MEDIUM

OpenClaw before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice call webhook handling that buffers request bodies before provider signature checks. Attackers can send large or malicious webhook requests to exhaust server resources without authentication by bypassing...

Full CISO analysis pending enrichment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

N/A

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A Low

What should I do?

No patch available

Monitor for updates. Consider compensating controls or temporary mitigations.

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-35626?

OpenClaw before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice call webhook handling that buffers request bodies before provider signature checks. Attackers can send large or malicious webhook requests to exhaust server resources without authentication by bypassing signature validation.

Is CVE-2026-35626 actively exploited?

No confirmed active exploitation of CVE-2026-35626 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35626?

No patch is currently available. Monitor vendor advisories for updates.

What is the CVSS score for CVE-2026-35626?

CVE-2026-35626 has a CVSS v3.1 base score of 5.3 (MEDIUM).

What are the technical details?

Original Advisory

OpenClaw before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice call webhook handling that buffers request bodies before provider signature checks. Attackers can send large or malicious webhook requests to exhaust server resources without authentication by bypassing signature validation.

Weaknesses (CWE)

CWE-405 Asymmetric Resource Consumption (Amplification)

CWE-405 — Asymmetric Resource Consumption (Amplification): The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

[Architecture and Design] An application must make resources available to a client commensurate with the client's access level.
[Architecture and Design] An application must, at all times, keep track of allocated resources and meter their usage appropriately.

Source: MITRE CWE corpus.