Openclaw cli: OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation (CVE-2026-35640)
Description
OpenClaw CLI's Feishu webhook component reads and parses JSON request bodies before validating the request signature in versions up to 2026.3.24. This behavior allows unauthenticated callers to force the server to perform full JSON parsing on potentially malicious or large payloads before the request is rejected. The issue was fixed in version 2026.3.25 by changing the code to validate the signature on the raw request body before parsing JSON.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in OpenClaw CLI (CVE-2026-35640) involves the Feishu webhook handler parsing JSON request bodies before validating the request signature. This flaw allows unauthenticated users to cause the server to expend resources parsing JSON payloads prior to signature verification, potentially leading to resource exhaustion or denial of service. The issue affects versions from 2026.1.29 up to but not including 2026.3.28 and was fixed in version 2026.3.25 by a commit that changed the processing order to validate signatures on raw request bodies before JSON parsing.
Potential Impact
Unauthenticated attackers can send requests that cause the server to perform expensive JSON parsing operations before rejecting the request due to invalid signatures. This could lead to resource exhaustion or denial of service conditions. There is no indication of direct code execution or data compromise from the provided information.
Mitigation Recommendations
A patch is available and should be applied. Users should upgrade OpenClaw CLI to version 2026.3.25 or later, where the signature validation occurs before JSON parsing, preventing unauthenticated requests from forcing unnecessary parsing work.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-35640
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 4.0
Threat ID: 6ac245d812601ec6a316809d
Added to database: 10/04/2026, 12:26:00 UTC
Last enriched: 10/04/2026, 13:19:56 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.