Openclaw cli: OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling (CVE-2026-35626)
Description
OpenClaw CLI versions prior to 2026.3.22 are vulnerable to unauthenticated resource exhaustion via its voice call webhook handling. The vulnerability arises because the webhook handler buffers request bodies before verifying provider signatures, allowing attackers to consume resources without authentication. This issue was fixed in version 2026.3.22 and later.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The OpenClaw CLI package (npm) has a vulnerability (CVE-2026-35626) in its voice call webhook handling component. The webhook handler buffers incoming request bodies before performing provider signature checks, which enables unauthenticated attackers to cause bounded resource exhaustion. The vulnerability affects versions from 2026.1.29 up to but not including 2026.3.22. The fix, committed in commit 651dc7450b68a5396a009db78ef9382633707ead, enforces header gating and shared pre-authentication body size limits before reading request bodies. Regression tests cover missing signatures, oversize payloads, and timeout scenarios to prevent recurrence.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to exhaust server resources by sending specially crafted webhook requests that are buffered before signature verification. This can degrade service availability or cause denial of service conditions. No authentication or user interaction is required to trigger the issue.
Mitigation Recommendations
A fix is available and shipped in OpenClaw CLI version 2026.3.22 and later. Users should upgrade to version 2026.3.22 or newer to mitigate this vulnerability. No additional mitigation steps are required beyond applying the official patch.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-35626
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 4.0
Threat ID: 6ac245ae12601ec6a3166b10
Added to database: 10/04/2026, 12:25:18 UTC
Last enriched: 10/04/2026, 12:56:16 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.