Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · OpenClaw

CVE-2026-35623: OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing

mediumCVSS 4.0 6.3 · 3.1 4.8GHSA-xq8g-hgh6-87hv

Summary BlueBubbles Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Password Affected Packages / Versions - Package: openclaw - Affected versions: <= 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details BlueBubbles webhook auth previously rejected wrong passwords without throttling repeated guesses, allowing brute-force…

Published Mar 27, 2026 · Updated Apr 18, 2026

Affected packages

openclaw

Ecosystem
npm
Affected
<= 2026.3.24
Fixed in
No patched version yet
Check
npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

BlueBubbles Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Password

Affected Packages / Versions

  • Package: openclaw
  • Affected versions: <= 2026.3.24
  • First patched version: 2026.3.25
  • Latest published npm version at verification time: 2026.3.24

Details

BlueBubbles webhook auth previously rejected wrong passwords without throttling repeated guesses, allowing brute-force attempts against weak webhook passwords. Commit 5e08ce36d522a1c96df2bfe88e39303ae2643d92 adds repeated-guess throttling before auth failure responses.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 5e08ce36d522a1c96df2bfe88e39303ae2643d92.

Fix Commit(s)

  • 5e08ce36d522a1c96df2bfe88e39303ae2643d92

Credited to zpbrent.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries