CVE-2026-32980highCWE-770

CVE-2026-32980: fallo de gravedad alta en OpenClaw

OpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook Request

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear OpenClaw+ Monitorear openclaw

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7epss 0.5%
OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests to the webhook endpoint to force memory consumption, socket time, and JSON parsing work before authentication validation occurs.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
OpenClaw · OpenClaw
CVEs relacionadas — OpenClaw

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-25253HIGHCVE-2026-25253EPSS 32.4%CVE-2026-44112HIGHOpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge WritesEPSS 7.3%CVE-2026-32917CRITICALOpenClaw < 2026.3.13 - Remote Command Injection via Unsanitized iMessage Attachment Paths in SCPEPSS 2.0%CVE-2026-3689MEDIUMOpenClaw Canvas Path Traversal Information Disclosure VulnerabilityEPSS 1.2%CVE-2026-53822HIGHOpenClaw < 2026.5.18 - Command Argument Modification via Shell Wrapper Between Approval and ExecutionEPSS 1.1%CVE-2026-32052MEDIUMOpenClaw < 2026.2.24 - Hidden Command Execution via Shell-Wrapper Positional argv CarriersEPSS 1.0%