CVE-2026-41913: OpenClaw < 2026.4.4 - Rate-Limit Bypass via Concurrent Async Authentication Attempts

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-28 · updated 2026-06-17
Weakness: CWE-362

Description

OpenClaw before 2026.4.4 contains a race condition vulnerability in shared-secret authentication that allows concurrent asynchronous requests to bypass the per-key rate-limit budget. Attackers can exploit this by sending multiple simultaneous authentication attempts to circumvent intended rate-limiting protections on Tailscale-capable paths.

Affected products

OpenClaw: before 2026.4.4 — fixed in 2026.4.4

How to fix

Upgrade to a fixed version: OpenClaw 2026.4.4. Check the vendor advisory for mitigations.

References

https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5
https://github.com/openclaw/openclaw/security/advisories/GHSA-25wv-8phj-8p7r
https://www.vulncheck.com/advisories/openclaw-rate-limit-bypass-via-concurrent-async-authentication-attempts

Get alerted when CVE-2026-41913 or the next vulnerability affects your stack