OpenClaw Webhook Rate Limiting Bypass Vulnerability

A vulnerability in OpenClaw versions prior to 2026.3.12 allows attackers to bypass rate limiting on webhook authentication. The issue arises because rate limiting is applied only after successful authentication, enabling repeated attempts to guess webhook secrets without triggering rate limit responses. This flaw facilitates systematic secret guessing, which can lead to forged webhook submissions.

Impact

Exploitation of this vulnerability makes it easier to brute-force weak webhook secrets, allowing for the submission of forged Zalo webhook traffic once a secret is successfully guessed.

Remediation

Users are advised to update to OpenClaw version 2026.3.12 or later and to use strong webhook secrets.