OpenClaw security vulnerabilities

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.25 contained a security vulnerability. This vulnerability stemmed from the lack of rate limiting in Telegram Webhook authentication, which could lead to brute-force attacks...

PT-2026-31764

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.25 Description OpenClaw contains a missing rate limiting issue in Telegram webhook authentication. This allows attackers to brute-force weak webhook secrets by repeatedly guessing without throttling. The...

GHSA-2VGC-VFH2-RW75

creationtimestamp| type| source ---|---|--- 2026-04-08 23:33:17+00:00| published-proof-of-concept| Telegram/twGuufhd-m5atHTFcaEGq3zekWSptxjF-dOJS4SFpStcSg...

GHSA-9R29-6JGC-3GGH

creationtimestamp| type| source ---|---|--- 2026-04-08 23:33:06+00:00| seen| Telegram/nb1jq11aD1wlJ1YglJrLy9zN5IvfOUCCPtd3YJ7-KFKCMzY...

GHSA-RFJ5-58HV-WC5F

creationtimestamp| type| source ---|---|--- 2026-04-08 23:33:06+00:00| seen| Telegram/nb1jq11aD1wlJ1YglJrLy9zN5IvfOUCCPtd3YJ7-KFKCMzY...

CVE-2026-34719

creationtimestamp| type| source ---|---|--- 2026-04-08 23:33:06+00:00| seen| Telegram/nb1jq11aD1wlJ1YglJrLy9zN5IvfOUCCPtd3YJ7-KFKCMzY 2026-04-08 23:33:17+00:00| published-proof-of-concept| Telegram/twGuufhd-m5atHTFcaEGq3zekWSptxjF-dOJS4SFpStcSg...

GHSA-24JW-F244-QFPP

creationtimestamp| type| source ---|---|--- 2026-04-08 23:32:54+00:00| published-proof-of-concept| Telegram/nyeqn3leA21ahM9eDPOdcOfg88eaiSN6Cc1j2Af2p1JdwTU...

CVE-2026-30814

creationtimestamp| type| source ---|---|--- 2026-04-08 23:32:54+00:00| published-proof-of-concept| Telegram/nyeqn3leA21ahM9eDPOdcOfg88eaiSN6Cc1j2Af2p1JdwTU 2026-05-07 14:00:05+00:00| seen| https://infosec.place/objects/5c5ce208-f36b-490d-8159-73a0851869dd...

GHSA-RPHV-H674-5HP2

creationtimestamp| type| source ---|---|--- 2026-04-08 23:32:54+00:00| published-proof-of-concept| Telegram/nyeqn3leA21ahM9eDPOdcOfg88eaiSN6Cc1j2Af2p1JdwTU...

CVE-2026-32589

creationtimestamp| type| source ---|---|--- 2026-04-08 23:32:47+00:00| seen| Telegram/ZztUGlJiiCH0mZAuu7v3RF9KN1NNH1hWH4kt4dDN5ep1QI 2026-07-01 14:13:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mplpaj7bv62b...

CVE-2026-32590

creationtimestamp| type| source ---|---|--- 2026-04-08 23:32:47+00:00| seen| Telegram/ZztUGlJiiCH0mZAuu7v3RF9KN1NNH1hWH4kt4dDN5ep1QI...

CVE-2025-24817

creationtimestamp| type| source ---|---|--- 2026-04-08 23:32:24+00:00| seen| Telegram/aEQe0P-AMU0sS3Jz8wPVEzQz8QZjOsktArIVrJmPyKpvP4...

CVE-2025-5835

creationtimestamp| type| source ---|---|--- 2026-04-08 23:31:21+00:00| seen| Telegram/uDb8p1iskXO6Pq5CJ62NBhUvl5M2Dmbo-CUN4HEs8fpntc...

CVE-2025-5831

creationtimestamp| type| source ---|---|--- 2026-04-08 23:31:21+00:00| seen| Telegram/uDb8p1iskXO6Pq5CJ62NBhUvl5M2Dmbo-CUN4HEs8fpntc...

CVE-2025-7359

creationtimestamp| type| source ---|---|--- 2026-04-08 23:31:21+00:00| seen| Telegram/uDb8p1iskXO6Pq5CJ62NBhUvl5M2Dmbo-CUN4HEs8fpntc...

CVE-2025-7360

creationtimestamp| type| source ---|---|--- 2026-04-08 23:31:01+00:00| seen| Telegram/-5CZewN2LChOSTaNFZSXdy0eNKAn7ggKAN00PMoPD6FJ4...

GHSA-VFHX-5459-QHQH

creationtimestamp| type| source ---|---|--- 2026-04-08 17:17:30+00:00| seen| Telegram/V1TSqfmZJdfaKpoymM9Em6O2uNbTcVHb7f-sjGIlQ-q3Tg...

GHSA-H259-74H5-4RH9

creationtimestamp| type| source ---|---|--- 2026-04-08 17:17:30+00:00| seen| Telegram/V1TSqfmZJdfaKpoymM9Em6O2uNbTcVHb7f-sjGIlQ-q3Tg...

MAL-2026-2516 Malicious code in sentinel-tool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5a2ff07802c4546c40d47d3780971506115297a1e8c177be36ad1e003dd62937 The package installs a remote executable that uses a hardcoded Telegram channel for monitoring the user's activity, including regularly taking screenshots, and...

Malicious code in sentinel-tool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5a2ff07802c4546c40d47d3780971506115297a1e8c177be36ad1e003dd62937 The package installs a remote executable that uses a hardcoded Telegram channel for monitoring the user's activity, including regularly taking screenshots, and...