CVE-2026-32980: Openclaw DOS Vulnerability

CVE-2026-32980 Overview

OpenClaw before version 2026.3.13 contains a resource exhaustion vulnerability in its Telegram webhook handling. The application reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests to the webhook endpoint to force memory consumption, socket time, and JSON parsing work before authentication validation occurs.

Critical Impact

Unauthenticated remote attackers can cause denial of service by exhausting server memory and CPU resources through crafted webhook requests, potentially taking down production services that rely on OpenClaw's Telegram integration.

Affected Products

• OpenClaw versions prior to 2026.3.13
• OpenClaw Node.js package (openclaw:openclaw)
• Applications using OpenClaw's Telegram webhook functionality

Discovery Timeline

• 2026-03-29 - CVE-2026-32980 published to NVD
• 2026-03-31 - Last updated in NVD database

Technical Details for CVE-2026-32980

Vulnerability Analysis

This vulnerability stems from improper ordering of authentication and resource-consuming operations in the webhook handling logic. The application performs expensive I/O operations (reading the full request body), memory allocation (buffering the content), and CPU-intensive work (JSON parsing) before validating whether the incoming request contains a valid authentication token.

This design flaw allows attackers to force the server to allocate resources for malicious requests without ever authenticating. Since no rate limiting or authentication occurs prior to resource consumption, an attacker can rapidly exhaust server memory and CPU by sending numerous large POST requests to the webhook endpoint.

The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling), reflecting the core issue of uncontrolled resource consumption.

Root Cause

The root cause is an authentication-bypass-through-ordering vulnerability. The webhook handler reads and parses the entire request body into memory before checking the x-telegram-bot-api-secret-token header for authentication. This inverted order of operations means unauthenticated requests consume server resources identically to legitimate authenticated requests until the very end of processing.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker simply needs to send HTTP POST requests to the known Telegram webhook endpoint. Each request forces the server to:

1. Accept the TCP connection and hold the socket open
2. Read the entire request body into memory
3. Parse the JSON content
4. Only then validate the authentication header (and reject the request)

By sending many concurrent requests with large payloads, an attacker can exhaust available memory and CPU resources, causing denial of service.

// Security patch demonstrating the fix
// Source: https://github.com/openclaw/openclaw/commit/7e49e98f79073b11134beac27fdff547ba5a4a02

+import { timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
 import { InputFile, webhookCallback } from "grammy";
 import type { OpenClawConfig } from "../config/config.js";

The patch imports timingSafeEqual from Node.js crypto module to validate the webhook secret header before reading the request body, ensuring authentication occurs prior to resource allocation.

Detection Methods for CVE-2026-32980

Indicators of Compromise

• Unusual volume of POST requests to the Telegram webhook endpoint
• Requests to the webhook endpoint lacking valid x-telegram-bot-api-secret-token headers
• Elevated memory consumption on servers running OpenClaw
• High CPU utilization correlated with incoming webhook traffic

Detection Strategies

• Monitor HTTP logs for POST requests to webhook endpoints with missing or invalid authentication headers
• Implement alerting for sudden spikes in request volume to webhook endpoints
• Track server memory and CPU metrics for anomalous resource consumption patterns
• Review application logs for repeated authentication failures on webhook endpoints

Monitoring Recommendations

• Configure web application firewall (WAF) rules to rate-limit unauthenticated webhook requests
• Set up infrastructure monitoring to alert on memory exhaustion conditions
• Enable detailed logging of authentication failures on webhook endpoints
• Implement network-level monitoring for traffic anomalies targeting webhook URLs

How to Mitigate CVE-2026-32980

Immediate Actions Required

• Upgrade OpenClaw to version 2026.3.13 or later immediately
• Review and audit any publicly exposed webhook endpoints
• Implement rate limiting at the network or application layer for webhook endpoints
• Consider temporarily disabling Telegram webhook functionality if upgrade is not immediately possible

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.3.13. The fix ensures that the x-telegram-bot-api-secret-token header is validated using timing-safe comparison before the request body is read or parsed.

Detailed patch information is available through the GitHub Commit and the GitHub Security Advisory.

Workarounds

• Place a reverse proxy with authentication in front of the webhook endpoint
• Implement IP allowlisting to restrict webhook access to Telegram's known IP ranges
• Configure rate limiting at the load balancer or WAF level to mitigate resource exhaustion
• Temporarily disable the webhook endpoint and use polling mode if immediate patching is not feasible

# Example: Rate limiting with nginx
location /telegram/webhook {
    limit_req zone=webhook_limit burst=10 nodelay;
    limit_req_status 429;
    proxy_pass http://openclaw_backend;
}