Openclaw cli: OpenClaw's hooks count non-POST requests toward auth lockout
Description
OpenClaw CLI versions up to 2026.3.2 have a vulnerability where non-POST HTTP requests to the /hooks/* endpoint are counted toward the authentication failure limit, allowing an unauthenticated attacker to trigger a temporary lockout of webhook delivery. This can cause temporary denial of service for legitimate webhook-triggered automation. The issue is fixed in version 2026.3.7, which correctly rejects unsupported HTTP methods with a 405 status without incrementing the auth failure count.
CVSS v3.1
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenClaw's HTTP handler for hooks incorrectly counted authentication failures for unsupported HTTP methods before rejecting them. An unauthenticated client could send repeated non-POST requests (e.g., GET) with invalid tokens to exhaust the authentication failure budget for a hook client key, causing a temporary lockout window. The fix moves the method check ahead of auth failure accounting so unsupported methods return 405 Method Not Allowed without affecting the auth limiter.
Potential Impact
An unauthenticated network client able to reach the /hooks/* endpoint can cause a temporary denial of service by locking out legitimate webhook delivery for clients sharing the same hook auth key, such as behind shared proxies or NAT. The impact is limited to temporary availability loss of webhook-triggered wake or automation delivery and does not affect confidentiality or integrity.
Mitigation Recommendations
A patch is available in openclaw version 2026.3.7, which corrects the handling of unsupported HTTP methods to prevent them from counting toward the authentication failure limit. Users should upgrade to version 2026.3.7 or later to remediate this issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-GHSA-6rmx-gvvg-vh6j
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac2458812601ec6a31640a4
Added to database: 10/04/2026, 12:24:40 UTC
Last enriched: 10/04/2026, 12:33:16 UTC
Last updated: 10/04/2026, 12:33:16 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.