OpenClaw prior to version 2026.3.22 is affected by an unauthenticated resource exhaustion vulnerability in its voice call webhook handling. The system buffers incoming request bodies before checking the provider signature, allowing an attacker to send large or malicious webhook requests that consume server resources without any authentication. As a result, a remote attacker can cause service disruption by exhausting CPU, memory, or disk bandwidth, negatively impacting availability.

The vulnerable product is OpenClaw, identified as OpenClaw:OpenClaw. Any deployment of OpenClaw running a version earlier than 2026.3.22 is at risk. The vulnerability is present in the Node.js based server component that processes voice call webhooks.

The CVSS score of 6.9 indicates medium severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, implying lower likelihood of widespread exploitation but still significant for exposed systems. The attack vector is inferred to be remote over the network, as the vulnerability is triggered by external webhook requests. The lack of authentication and signature validation before buffering creates a feasible exploitation path where an attacker can send crafted requests to induce resource exhaustion.