5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-6rmx-gvvg-vh6j

GHSA-6rmx-gvvg-vh6j: OpenClaw's hooks count non-POST requests toward auth lockout

OpenClaw's hooks HTTP handler counted hook authentication failures before rejecting unsupported HTTP methods. An unauthenticated client could send repeated non-POST requests (for example GET) with an invalid token to consume the hook auth failure budget and trigger the temporary lockout window for that client key.

The fix moves the hook method gate ahead of auth-failure accounting so unsupported methods return 405 Method Not Allowed without incrementing the hook auth limiter.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.3.2
Patched version: 2026.3.7
Latest published npm version at patch time: 2026.3.2

Impact

An unauthenticated network client that could reach /hooks/* could temporarily lock out legitimate webhook delivery when requests collapsed to the same hook auth client key, such as shared proxy or NAT topologies. Impact is limited to temporary availability loss for hook-triggered wake or automation delivery.

Fix Commit(s)

44820dceadac65ac7c0ce8fc0ffba8c2bd9fae89

Verification

pnpm check passed
pnpm test:fast passed
focused hook regression tests passed
pnpm exec vitest run --config vitest.gateway.config.ts still has unrelated current-main failures in src/gateway/server-channels.test.ts and src/gateway/server-methods/agents-mutate.test.ts

Release Process Note

npm 2026.3.7 was published on March 8, 2026. This advisory is fixed in the released package.

Thanks @JNX03 for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-6rmx-gvvg-vh6j

GHSA-6rmx-gvvg-vh6j:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.2	2026.3.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided commit 44820dceadac65ac7c0ce8fc0ffba8c2bd9fae89 clearly indicates that the vulnerability lies within the createHooksRequestHandler function in the file src/gateway/server-http.ts. The patch itself demonstrates the flaw: the check for the request's HTTP method (req.method !== "POST") was performed after the authentication logic, including the counting of authentication failures. This incorrect ordering is the root cause of the vulnerability. By sending repeated non-POST requests, an attacker could trigger the authentication failure lockout mechanism, leading to a temporary denial of service for legitimate webhooks. The vulnerable function is therefore createHooksRequestHandler as it contains the flawed logic that was corrected by the patch.

Vulnerable functions

createHooksRequestHandler

src/gateway/server-http.ts

The vulnerability existed in the `createHooksRequestHandler` function, which handled incoming webhooks. Before the patch, this function would perform authentication checks and count authentication failures before validating the HTTP request method. An attacker could exploit this by sending numerous non-POST requests (e.g., GET) with invalid credentials. Each of these requests would be counted as an authentication failure, eventually triggering the rate limiter and causing a temporary lockout (Denial of Service) for legitimate webhook deliveries, which use the POST method. The fix reordered the logic to first check the request method and reject non-POST requests before any authentication logic is processed, thus preventing the exhaustion of the authentication failure budget.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.