CVE-2026-34505: Rate Limiting Bypass in openclaw

The core of this vulnerability lies in the improper implementation of rate limiting within the Zalo webhook handler. Instead of applying rate limits before authentication, the system only enforced them after a secret was successfully verified. This meant that attempts to guess the webhook secret, even with incorrect credentials, did not contribute to the rate limit counter. An attacker could therefore rapidly iterate through potential secrets, significantly reducing the time required to compromise the system. Successful secret guessing then allows the attacker to submit malicious Zalo webhook traffic, potentially leading to data manipulation, unauthorized actions, or other security breaches depending on the application's logic.

1. Reserved2026-03-30
2. Published2026-03-13
3. Modified2026-04-06
4. EPSS updated2026-04-07

The primary mitigation for CVE-2026-34505 is to upgrade openclaw to version 2026.3.12 or later, which includes the corrected rate limiting implementation. If upgrading is not immediately possible, consider implementing a Web Application Firewall (WAF) rule to block excessive requests to the webhook endpoint. Specifically, the WAF should be configured to rate limit requests based on the source IP address or other identifying factors, regardless of authentication status. Monitor webhook logs for unusual activity, such as a high volume of requests with invalid secrets. Review and strengthen webhook secret policies to enforce strong, randomly generated secrets.