AI agent vulnerability · OpenClaw

CVE-2026-41343: OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification

mediumCVSS 4.0 6.9 · 3.1 5.3GHSA-qcc3-jqwp-5vh2

Summary LINE webhook handler lacks shared pre-auth concurrency budget before signature verification Current Maintainer Triage - Status: open - Normalized severity: low - Assessment: Shipped v2026.3.28 lacks a shared pre-auth concurrency budget on the public LINE webhook path, but the effect is bounded transient availability loss only, so low fits.

Published Apr 2, 2026 · Updated May 6, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: <= 2026.3.28
Fixed in: 2026.3.31
Check: npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

LINE webhook handler lacks shared pre-auth concurrency budget before signature verification

Current Maintainer Triage

Status: open
Normalized severity: low
Assessment: Shipped v2026.3.28 lacks a shared pre-auth concurrency budget on the public LINE webhook path, but the effect is bounded transient availability loss only, so low fits.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

57c47d8c7fbf5a2e70cc4dec2380977968903cad — 2026-03-31T19:34:25+09:00

OpenClaw thanks @nexrin for reporting.

Credited to nexrin, KeenSecurityLab, qclawer.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries