A race condition in OpenClaw’s shared‑secret authentication mechanism allows an attacker to send concurrent asynchronous requests that bypass the per‑key rate‑limit budget. The result is that standard rate‑limiting controls on Tailscale‑capable paths are defeated, giving the attacker the ability to perform repeated authentication attempts without being throttled. While the CVSS score of 6.3 indicates a moderate severity, the impact is primarily the removal of a key security safeguard and the potential for resource exhaustion or brute‑force enumeration.

OpenClaw versions prior to 2026.4.4 are affected, meaning any deployment running 2026.4.3 or older is vulnerable. The issue applies to environments that rely on OpenClaw’s shared‑secret authentication for Tailscale‑enabled paths.

The CVSS score of 6.3 places the flaw in the medium severity range. No EPSS value is available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: an attacker can issue multiple simultaneous authentication requests over the network, a scenario inferred from the description of concurrent async attempts. If an attacker can reach the authentication endpoint, the race condition can be exploited to replay authentication attempts rapidly, effectively disabling the intended throttle.