Vulnerability
CVE-2026-100571
Descriptive record received from OpenCTI and minimised for consultation in the Intel portal.
- Sharing
- PUBLIC-OSINT
- Confidence
- 100
- Source
- The CVE Program
- Updated
- 26/09/2026 08:15
Description
OpenClaw (npm package 'openclaw') versions >= 2026.6.6 and < 2026.8.1 apply the SMS webhook invalid-request rate limit before Twilio signature verification and identify clients only by the raw proxy socket address. In deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunnel so that multiple external clients share one socket address, an unauthenticated remote sender can exhaust the shared pre-authentication rate-limit budget with invalid requests, causing subsequent correctly signed Twilio callbacks to receive HTTP 429 responses. The result is temporary inbound SMS loss while the shared window remains exhausted; the attacker cannot forge a callback or access message data. Fixed in 2026.8.1.
Aliases and classifications
CWE-400Uncontrolled Resource Consumption
Minimised technical details
No raw data- cisa kev
- False
- cvss score
- 5.3
- cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- cvss severity
- MEDIUM
Provenance
Public references
- GitHub Security Advisory (GHSA-xw48-j584-r73h)
https://github.com/openclaw/openclaw/security/advisories/GHSA-xw48-j584-r73h - VulnCheck Advisory: OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass
https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-sms-webhook-rate-limit-bypass
EudorIA correlation
Intel catalogue
The vulnerability is also available in the EudorIA editorial catalogue.
Open EudorIA analysisPresence in OpenCTI describes an intelligence correlation and does not, by itself, constitute evidence of compromise, legal attribution or operational guidance applicable without context verification.