A flaw in OpenClaw versions prior to 2026.3.31 causes pending pairing‑request caps to be enforced per channel file instead of per account. This allows an attacker to submit a large number of pairing requests from different accounts, exhausting the shared pending window and preventing new pairing challenges from being generated for other accounts. The attack elevates to a denial of service because affected accounts can no longer initiate new pairing processes, disrupting legitimate users and services. The weakness is a type of logic error (CWE‑799) where a policy is applied at an incorrect granularity.

The issue impacts the OpenClaw product named OpenClaw, affecting all installations running OpenClaw versions 2026.2.26 up to, but not including, 2026.3.31. No other vendors or product variants are mentioned as affected.

The CVSS score of 6.3 places this vulnerability in the moderate severity category. The EPSS score indicates a very low but non‑zero exploitation probability, and it is not listed in the CISA KEV catalog. Attackers can exploit this by sending pairing requests remotely from other accounts; the easiest vector is through network access to the OpenClaw service. If the attacker can maintain enough concurrent requests to fill the per‑channel quota, all other accounts are effectively locked out of pairing, leading to a denial of service for those users.