CVE-2026-41405

OpenClaw < 2026.3.31 - Resource Exhaustion via Unauthenticated MS Teams Webhook Body Parsing

Published Apr 28, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhaustion. Remote attackers can send malicious Teams webhook payloads to exhaust server resources by bypassing authentication checks.

Analysis

Technical impact

The vulnerability originates from OpenClaw processing Microsoft Teams webhook request bodies before performing JWT validation. An unauthenticated user can send specially crafted payloads that consume excessive CPU or memory, potentially causing a denial of service for legitimate users.

Affected Systems

OpenClaw OpenClaw, any version older than 2026.3.31.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. Because the flaw is exploitable remotely and does not require authentication, the risk of exploitation is significant. No EPSS data is available and the issue is not listed in the CISA KEV catalog, but the attack vector is straightforward: attackers can send malicious Teams webhook payloads to any exposed OpenClaw instance.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OpenClaw

unaffected

Version	Status	Constraints
`0`	affected	< 2026.3.31
`2026.3.31`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

No data.

Vendor Product Versions

Openclaw

Version	Status	Scheme	Platform
`[0,2026.3.31)`	affected	semver	—
`2026.3.31`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade OpenClaw to version 2026.3.31 or later, which includes the fix for unchecked body parsing before JWT validation.
Configure the server to enforce authentication (JWT validation) before processing any request bodies, ensuring only authorized requests are parsed.
Implement limits on request size or other rate‑limiting controls for incoming webhook payloads to reduce the impact of potential resource exhaustion attempts.

Generated by OpenCVE AI on April 29, 2026 at 01:22 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-p464-m8x6-vhv8	OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.481% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/openclaw/openclaw/commit/3834d47099dd13c8244ed6de8b9ea9855c553623
https://github.com/openclaw/openclaw/security/advisories/GHSA-p464-m8x6-vhv8
https://www.vulncheck.com/advisories/openclaw-resource-exhaustion-via-unauthenticated-ms-teams-webhook-body-parsing

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 28, 2026 7:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhaustion. Remote attackers can send malicious Teams webhook payloads to exhaust server resources by bypassing authentication checks.
Title		OpenClaw < 2026.3.31 - Resource Exhaustion via Unauthenticated MS Teams Webhook Body Parsing
First Time appeared		Openclaw Openclaw openclaw
Weaknesses		CWE-408
CPEs		cpe:2.3:a:openclaw:openclaw::::::node.js::*
Vendors & Products		Openclaw Openclaw openclaw
References		https://github.com/openclaw/openclaw/commit/3834d47099dd13c8244ed6de8b9ea9855c553623 https://github.com/openclaw/openclaw/security/advisories/GHSA-p464-m8x6-vhv8 https://www.vulncheck.com/advisories/openclaw-resource-exhaustion-via-unauthenticated-ms-teams-webhook-body-parsing
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`