CVE-2026-35628: OpenClaw webhook brute-force

CISO Take

OpenClaw's Telegram webhook integration lacks rate limiting on authentication attempts, allowing attackers to systematically enumerate weak webhook secrets without throttling, lockout, or detection. Although CVSS is medium (4.8), this vulnerability sits in the top 80th EPSS percentile for exploitation likelihood, and OpenClaw's documented history of third-party ecosystem abuse — including the February 2026 AMOS stealer incident via malicious skills — elevates real-world risk for organizations running AI agents over Telegram. A successful brute-force grants an attacker the ability to inject arbitrary messages into the AI agent's input channel, directly enabling prompt injection, unauthorized tool invocation, or data exfiltration through the agent's connected capabilities. Patch immediately to OpenClaw 2026.3.25, rotate all webhook secrets treating prior values as compromised, and implement network-level IP allowlisting restricted to Telegram's documented IP ranges as defense-in-depth.

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Medium technical severity elevated by AI agent context. High attack complexity (AC:H) partially offsets risk, but the absence of rate limiting transforms brute-force from infeasible to practical for determined adversaries, particularly against weak or default secrets common in development deployments. With only 4 downstream dependents the blast radius is contained, but any compromise of webhook authentication directly exposes the AI agent's trust boundary — a high-value target. The 396 prior CVEs in the same package, combined with documented ecosystem abuse (AIID #1368), signal a pattern of insufficient security investment in OpenClaw. No public exploit or KEV listing reduces immediate urgency, but top-80th-percentile EPSS warrants prompt remediation.

How does the attack unfold?

Reconnaissance

Attacker identifies an internet-exposed OpenClaw instance with a Telegram webhook configured, discoverable via Shodan queries, public code repository leaks, or Telegram bot enumeration.

AML.T0006

Brute-Force Authentication

Attacker scripts rapid sequential HTTP requests to the webhook endpoint with guessed secrets, exploiting the absence of rate limiting to systematically enumerate weak or common values without triggering lockout.

AML.T0049

Webhook Compromise

Correct webhook secret identified; attacker gains authenticated access to inject arbitrary messages into the OpenClaw agent's Telegram input channel, bypassing all intended trust controls.

AML.T0055

Agent Manipulation and Impact

Attacker injects crafted prompt payloads through the compromised channel, causing the AI agent to exfiltrate sensitive data, invoke unauthorized tool calls, or execute actions against connected internal systems on the attacker's behalf.

AML.T0080

Reconnaissance

Attacker identifies an internet-exposed OpenClaw instance with a Telegram webhook configured, discoverable via Shodan queries, public code repository leaks, or Telegram bot enumeration.

AML.T0006

Brute-Force Authentication

Attacker scripts rapid sequential HTTP requests to the webhook endpoint with guessed secrets, exploiting the absence of rate limiting to systematically enumerate weak or common values without triggering lockout.

AML.T0049

Webhook Compromise

Correct webhook secret identified; attacker gains authenticated access to inject arbitrary messages into the OpenClaw agent's Telegram input channel, bypassing all intended trust controls.

AML.T0055

Agent Manipulation and Impact

Attacker injects crafted prompt payloads through the compromised channel, causing the AI agent to exfiltrate sensitive data, invoke unauthorized tool calls, or execute actions against connected internal systems on the attacker's behalf.

AML.T0080

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

4.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C Low

I Low

A None

What should I do?

6 steps

Patch: Upgrade OpenClaw to version 2026.3.25 or later immediately (patch commit c2c136ae9517ddd0789d742a0fdf4c10e8c729a7).
Rotate secrets: Treat all previously configured Telegram webhook secrets as compromised and regenerate using cryptographically random values of at least 32 characters.
Network controls: Restrict webhook endpoint access to Telegram's official IP ranges at the firewall or reverse proxy layer — this eliminates the attack surface for non-Telegram sources regardless of secret strength.
Monitoring: Review webhook call logs for anomalous authentication failure patterns, high-frequency requests, or traffic originating from non-Telegram IP space.
Skill audit: If running OpenClaw with third-party skills, audit installed skills against the GHSA-vcx4-4qxg-mfp4 advisory given documented ecosystem abuse.
Detection: Alert on sequential authentication failures to the webhook endpoint as an indicator of active brute-force attempts.

How is it classified?

Auth Bypass Prompt Injection Agent API AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0055 - Unsecured Credentials AML.T0080 - AI Agent Context Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.9.4 - Access control

NIST AI RMF

GOVERN 6.2 - Policies and practices to address AI risk

OWASP LLM Top 10

LLM01:2025 - Prompt Injection

Frequently Asked Questions

What is CVE-2026-35628?

OpenClaw's Telegram webhook integration lacks rate limiting on authentication attempts, allowing attackers to systematically enumerate weak webhook secrets without throttling, lockout, or detection. Although CVSS is medium (4.8), this vulnerability sits in the top 80th EPSS percentile for exploitation likelihood, and OpenClaw's documented history of third-party ecosystem abuse — including the February 2026 AMOS stealer incident via malicious skills — elevates real-world risk for organizations running AI agents over Telegram. A successful brute-force grants an attacker the ability to inject arbitrary messages into the AI agent's input channel, directly enabling prompt injection, unauthorized tool invocation, or data exfiltration through the agent's connected capabilities. Patch immediately to OpenClaw 2026.3.25, rotate all webhook secrets treating prior values as compromised, and implement network-level IP allowlisting restricted to Telegram's documented IP ranges as defense-in-depth.

Is CVE-2026-35628 actively exploited?

No confirmed active exploitation of CVE-2026-35628 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35628?

1. Patch: Upgrade OpenClaw to version 2026.3.25 or later immediately (patch commit c2c136ae9517ddd0789d742a0fdf4c10e8c729a7). 2. Rotate secrets: Treat all previously configured Telegram webhook secrets as compromised and regenerate using cryptographically random values of at least 32 characters. 3. Network controls: Restrict webhook endpoint access to Telegram's official IP ranges at the firewall or reverse proxy layer — this eliminates the attack surface for non-Telegram sources regardless of secret strength. 4. Monitoring: Review webhook call logs for anomalous authentication failure patterns, high-frequency requests, or traffic originating from non-Telegram IP space. 5. Skill audit: If running OpenClaw with third-party skills, audit installed skills against the GHSA-vcx4-4qxg-mfp4 advisory given documented ecosystem abuse. 6. Detection: Alert on sequential authentication failures to the webhook endpoint as an indicator of active brute-force attempts.

What systems are affected by CVE-2026-35628?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI chatbots with messaging platform integrations, enterprise Telegram bots.

What is the CVSS score for CVE-2026-35628?

CVE-2026-35628 has a CVSS v3.1 base score of 4.8 (MEDIUM). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI chatbots with messaging platform integrationsenterprise Telegram bots

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0055 Unsecured Credentials

AML.T0080 AI Agent Context Poisoning

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.9.4

NIST AI RMF: GOVERN 6.2

OWASP LLM Top 10: LLM01:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allows attackers to brute-force weak webhook secrets. The vulnerability enables repeated authentication guesses without throttling, permitting attackers to systematically guess webhook secrets through brute-force attacks.

Exploitation Scenario

An attacker discovers an internet-exposed OpenClaw instance through Shodan queries targeting known webhook URL patterns or via leaked configuration in a public code repository. Using a scripted tool, the attacker sends rapid sequential POST requests to the Telegram webhook endpoint with guessed secrets — short strings, dictionary words, or base64-encoded common values — without triggering any server-side throttle or lockout. After successfully matching the correct secret, the attacker gains authenticated access to the agent's input channel. The attacker then crafts prompt injection payloads delivered as Telegram messages, instructing the AI agent to enumerate its connected tools, exfiltrate its system prompt, or execute authorized-but-unintended actions against internal APIs or data stores the agent can legitimately access.

Weaknesses (CWE)

CWE-307 Improper Restriction of Excessive Authentication Attempts

CWE-307 — Improper Restriction of Excessive Authentication Attempts: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

[Architecture and Design] Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

Source: MITRE CWE corpus.