CVE-2026-32049: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32049 is a denial-of-service vulnerability in OpenClaw (npm package) caused by inconsistent enforcement of configured inbound media byte limits across multiple channel ingestion paths. Versions prior to 2026.2.22 are affected, including all releases up to and including 2026.2.21-2. The vulnerability was published on March 21, 2026, with a patch committed on the same date. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-400 (Uncontrolled Resource Consumption). OpenClaw failed to consistently apply configured inbound media byte limits before buffering remote media during the download/read phase across multiple channel integrations, including Discord, Telegram, Zalo, Microsoft Teams, and BlueBubbles. The fix (commit 73d93de) refactored attachment download logic to route through a centralized fetchRemoteMedia runtime method that enforces maxBytes limits during the fetch operation itself, rather than after the full payload has been buffered into memory. No authentication, user interaction, or special privileges are required to trigger the vulnerability over the network (GitHub Commit, GitHub Advisory).

Successful exploitation causes elevated memory consumption in the OpenClaw Node.js process, potentially leading to process instability or a full denial-of-service condition. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Because no authentication is required and the attack is network-accessible with low complexity, any internet-exposed OpenClaw instance is at risk of service disruption through repeated oversized media payload submissions (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.158%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the low exploitation probability, the attack requires no authentication and no user interaction, making it trivially automatable against exposed instances (Feedly).

1. Reconnaissance: Identify internet-accessible OpenClaw instances running npm package versions ≤ 2026.2.21-2 using network scanning tools or package registry metadata.
2. Identify media ingestion endpoints: Determine which channel integrations are active (Discord, Telegram, Zalo, Microsoft Teams, BlueBubbles) on the target instance, as each exposes a separate vulnerable media ingestion path.
3. Craft oversized media payload: Prepare a media file or URL reference that exceeds the configured maxBytes limit for the target channel's media download handler.
4. Send payload: Submit the oversized media payload to the target OpenClaw instance via the appropriate channel (e.g., send a large file attachment through a connected messaging platform).
5. Trigger memory exhaustion: The vulnerable code buffers the entire remote media payload into memory before checking the size limit, causing memory pressure. Repeated submissions can escalate to process instability or crash (GitHub Advisory, GitHub Commit).

• Process: Sustained or spiking memory usage in the OpenClaw Node.js process without a corresponding increase in legitimate user activity; process crashes or OOM (out-of-memory) kills in system logs.
• Logs: Repeated attachment download attempts from unexpected or external sources across Discord, Telegram, Zalo, Microsoft Teams, or BlueBubbles channel logs; error messages referencing attachment size or memory limits appearing in OpenClaw logs.
• Network: High-volume or repeated inbound media fetch requests originating from a single or small set of external IP addresses targeting the OpenClaw service.

Upgrade OpenClaw (npm) to version 2026.2.22 or later, which enforces inbound media byte limits during the fetch/read phase via the centralized fetchRemoteMedia runtime method across all affected channel integrations (Discord, Telegram, Zalo, Microsoft Teams, BlueBubbles). No configuration-based workaround is available for unpatched versions, as the byte limit enforcement was architecturally absent in the ingestion path. Organizations should prioritize patching given the unauthenticated, network-accessible nature of the vulnerability (GitHub Advisory, GitHub Commit).

The OpenClaw vendor published a blog post in late March 2026 summarizing nine CVEs disclosed over a four-day period in March 2026, of which CVE-2026-32049 was one (OpenClaw Blog). The vulnerability was reported by researcher @tdjackey and acknowledged in the GitHub security advisory and CHANGELOG. Social media activity was limited to automated CVE alert accounts on Bluesky and Mastodon, with no notable independent researcher commentary identified.