What’s Vulnerable › Vulnerabilities

CVE-2026-41333: OpenClaw < 2026.3.31 - Authentication Rate Limiting Bypass via Fake DeviceToken

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-23 · updated 2026-06-17
• Weakness: CWE-799

Description

OpenClaw before 2026.3.31 contains an authentication rate limiting bypass vulnerability that allows attackers to circumvent shared authentication protections using fake device tokens. Attackers can exploit the mixed WebSocket authentication flow to bypass rate limiting controls and conduct brute force attacks against weak shared passwords.

Affected products

• OpenClaw: before 2026.3.31 — fixed in 2026.3.31

How to fix

Upgrade to a fixed version: OpenClaw 2026.3.31. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/commit/af0c0862f22ca4492406a3103d05e3628f94cbe9
• https://github.com/openclaw/openclaw/security/advisories/GHSA-6p8r-6m93-557f
• https://www.vulncheck.com/advisories/openclaw-authentication-rate-limiting-bypass-via-fake-devicetoken

Get alerted when CVE-2026-41333 or the next vulnerability affects your stack