CVE-2026-41405

HIGH8.7

OpenClaw < 2026.3.31 - Resource Exhaustion via Unauthenticated MS Teams Webhook Body Parsing

Published Apr 28, 2026

Modified 3 weeks ago

Details

OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhaustion. Remote attackers can send malicious Teams webhook payloads to exhaust server resources by bypassing authentication checks.

References

FIX

https://github.com/openclaw/openclaw/commit/3834d47099dd13c8244ed6de8b9ea9855c553623

ADVISORY

https://github.com/openclaw/openclaw/security/advisories/GHSA-p464-m8x6-vhv8

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-41405

ADVISORY

https://www.vulncheck.com/advisories/openclaw-resource-exhaustion-via-unauthenticated-ms-teams-webhook-body-parsing

CVSS Analysis

CVSS v4.0

8.7