CVE-2026-41333

Katalog CVE

CVSS 3.7 · Low EPSS 0,42%

Kerentanan Improper Control of Interaction Frequency pada openclaw. Skor CVSS 3.1 3.7 (Low) menurut vulncheck.com.

Deskripsi (NVD)

OpenClaw before 2026.3.31 contains an authentication rate limiting bypass vulnerability that allows attackers to circumvent shared authentication protections using fake device tokens. Attackers can exploit the mixed WebSocket authentication flow to bypass rate limiting controls and conduct brute force attacks against weak shared passwords.

Rincian

Terbit di NVD

23 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.7 (Low), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-799: Improper Control of Interaction Frequency

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-6p8r-6m93-557f advisory vendor
• https://github.com/openclaw/openclaw/commit/af0c0862f22ca4492406a3103d05e3628f94cbe9 patch
• https://www.vulncheck.com/advisories/openclaw-authentication-rate-limiting-bypass-via-fake-devicetoken advisory pihak ketiga