The OpenClaw npm package versions >=2026.6.6 and <2026.8.1 implement SMS webhook invalid-request rate limiting prior to Twilio signature verification and rely on raw proxy socket addresses for client identification. When deployed behind a trusted reverse proxy or tunnel, multiple external clients share the same socket address. An unauthenticated remote attacker can send invalid requests to exhaust the shared pre-authentication rate-limit budget, causing subsequent legitimate Twilio callbacks to receive HTTP 429 responses. This leads to temporary inbound SMS loss while the rate limit window is exhausted. The attacker cannot forge callbacks or access message content. The vulnerability is resolved in version 2026.8.1.

The vulnerability causes temporary denial of inbound SMS messages due to exhaustion of the shared rate-limit window by unauthenticated invalid requests. There is no impact on confidentiality or integrity as attackers cannot forge callbacks or access message data. The availability impact is limited to temporary inbound SMS loss during the rate-limit exhaustion period.

Upgrade OpenClaw to version 2026.8.1 or later, where the issue is fixed. This update ensures that rate limiting is applied after Twilio signature verification and improves client identification to prevent exhaustion of the shared rate-limit budget. No other mitigation is required.