VulnSocial

CVE-2026-28461Disclosure(openclaw / openclaw)

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger in-memory key accumulation by varying query strings. Remote attackers can exploit this by sending repeated requests with different query parameters to cause memory pressure, process instability, or out-of-memory conditions that degrade service availability.

openclaw CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • openclaw

Threat summary

  • 5 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 4 signals
  • Disclosure: 5 classified signals
  • Peaked 1d ago at 4 mentions (2026-03-19); latest day: 1
  • 5 total mentions across 2 days

Affected systems

Vendors
openclaw
Products
openclaw

Deep dive

Activity timeline5 mentions / 2d
01234Mentions · 2026-03-19: 4Mentions · 2026-03-21: 1Technical Details · 2026-03-19: 3Technical Details · 2026-03-21: 103-1903-21
Signal classification1 categories
Disclosure
5100.0%
Referenced assets6 URLs
Classification over time
DateTotalLabels
2026-03-194
Disclosure4
2026-03-211
Disclosure1
Full discourse5 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-28461 Unauthenticated Memory Exhaustion Vulnerability in OpenClaw Zalo Webhook... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28461 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3

    Post summary

    A newly identified unauthenticated memory exhaustion vulnerability in OpenClaw Zalo Webhook (CVE-2026-28461) is reported, with links to detailed information but no PoC, exploit, or patch details provided.

    10022142
    4.0K followersView on X
  • CVEarity@CVEarity
    Disclosure

    ⚡ New CVE Alert: CVE-2026-28461 📊 Severity: 7.5 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-28461 #CVE-2026-28461 #CVE #High  #CyberSecurity #InfoSec https://t.co/nKraAPRa9X

    Post summary

    A new CVE (CVE-2026-28461) has been announced with a medium‑high severity score; no PoC, exploitation details, or patches are provided.

    0000029
    108 followersView on X
  • VulnTracker@vuln_tracker
    Disclosure

    🚨 6 high-severity CVEs dropped today for OpenClaw - the popular AI automation platform CVE-2026-28461 (7.5) - Memory exhaustion via webhook CVE-2026-31989 (7.4) - SSRF via web_search CVE-2026-27566 (7.1) - Allowlist bypass CVE-2026-31992 (7.1) - Exec-guard bypass CVE-2026-31994 (7.1) - Command injection CVE-2026-31998 (7.0) - Auth bypass Popular platforms = bigger targets. Track everything: http://vulntracker.io

    Post summary

    The post announces the disclosure of six new high‑severity CVEs affecting OpenClaw, presenting their identifiers, CVSS scores, and brief vulnerability types, but provides no PoC, exploit details, or mitigation information.

    00000124
    433 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-28461 OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger in-… https://www.cve.org/CVERecord?id=CVE-2026-28461

    Post summary

    The article announces CVE-2026-28461, describing an unbounded memory growth issue in OpenClaw's Zalo webhook endpoint that allows unauthenticated attackers to trigger it—a straightforward vulnerability disclosure with no PoC, exploit, mitigation, or active exploitation mentioned.

    00000110
    56.7K followersView on X
  • RedPacket Security@RedPacketSec
    Disclosure

    CVE Alert: CVE-2026-28461 - OpenClaw - OpenClaw - https://www.redpacketsecurity.com/cve-alert-cve-2026-28461-openclaw-openclaw/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-28461 #openclaw #

    Post summary

    The tweet announces the existence of CVE-2026-28461 for OpenClaw and directs readers to an external CVE alert page.

    0000070
    3.6K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appopenclawopenclaw-node.js-

Explore more

Back to dashboardopenclaw CVEsopenclaw vulnerabilities