Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| OpenClaw | OpenClaw | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sat, 26 Sep 2026 02:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunnel so that multiple external clients share one socket address, an unauthenticated remote sender can exhaust the shared pre-authentication rate-limit budget with invalid requests, causing subsequent correctly signed Twilio callbacks to receive HTTP 429 responses. The result is temporary inbound SMS loss while the shared window remains exhausted; the attacker cannot forge a callback or access message data. Fixed in 2026.8.1. | |
| Title | OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass | |
| First Time appeared |
Openclaw
Openclaw openclaw |
|
| Weaknesses | CWE-400 | |
| CPEs | cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Openclaw
Openclaw openclaw |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-09-26T02:19:00.237Z
Reserved: 2026-09-26T01:03:10.863Z
Link: CVE-2026-100571
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-26T03:17:04.330
Modified: 2026-09-26T03:17:04.330
Link: CVE-2026-100571
Redhat
No data.
OpenCVE Enrichment
No data.