Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck
CVE-2026-100571OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass
Medium 5.3
In plain English
A medium-severity uncontrolled resource consumption in OpenClaw from OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).
Official description
OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunnel so that multiple external clients share one socket address, an unauthenticated remote sender can exhaust the shared pre-authentication rate-limit budget with invalid requests, causing subsequent correctly signed Twilio callbacks to receive HTTP 429 responses. The result is temporary inbound SMS loss while the shared window remains exhausted; the attacker cannot forge a callback or access message data. Fixed in 2026.8.1.
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- GitHub Security Advisory (GHSA-xw48-j584-r73h) vendor-advisory
- VulnCheck Advisory: OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass third-party-advisory