CVE-2026-35628: Openclaw

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allows attackers to brute-force weak webhook secrets. The vulnerability enables repeated authentication guesses without throttling, permitting attackers to systematically guess webhook secrets through brute-force attacks.

Affected products

• Openclaw Openclaw: before 2026.3.25 (fixed in 2026.3.25)

Published 2026-04-09. Last modified 2026-06-17.