CVE-2026-41343: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41343 is a denial-of-service vulnerability in OpenClaw, a Node.js-based messaging automation platform, caused by the absence of a shared pre-authentication concurrency budget on the public LINE webhook endpoint. Versions up to and including 2026.3.28 (npm package openclaw) are affected; version 2026.3.31 contains the fix. Remote, unauthenticated attackers can flood the webhook path with concurrent requests before signature verification occurs, exhausting server resources and causing transient service degradation. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Duplicate Advisory).

The root cause is classified as CWE-799 (Improper Control of Interaction Frequency): the LINE webhook handler accepted an unbounded number of concurrent POST requests and began processing — including reading the request body — before performing LINE signature verification. Because no concurrency cap existed at the pre-authentication stage, an attacker could saturate the handler's resource pool (CPU, memory, I/O) with simultaneous unauthenticated requests. The fix (commit 57c47d8) introduces a createWebhookInFlightLimiter and beginWebhookRequestPipelineOrReject guard that enforces a shared in-flight slot budget per account key (line:<accountId>); requests exceeding the limit receive an immediate HTTP 429 response before any body handling occurs (Fix Commit, GitHub Advisory).

Successful exploitation results in transient availability loss for the OpenClaw service — specifically the LINE messaging integration — without any impact to confidentiality or data integrity. An attacker can degrade or temporarily disrupt webhook processing, causing LINE messages to go unhandled during the attack window. The scope is limited to the vulnerable system itself; there is no evidence of lateral movement potential or data exposure risk associated with this vulnerability (Duplicate Advisory, GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires no authentication, no user interaction, and no special privileges, making it trivially automatable from any network location. The EPSS score is approximately 0.088% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Duplicate Advisory, Feedly).

1. Reconnaissance: Identify internet-facing OpenClaw instances running versions ≤2026.3.28 (npm package openclaw) that expose a LINE webhook endpoint, typically at a path such as /line/webhook.
2. Craft concurrent requests: Prepare a large number of HTTP POST requests targeting the LINE webhook endpoint. No valid LINE signature or authentication token is required at this stage.
3. Flood the endpoint: Send the crafted POST requests concurrently (e.g., using tools like ab, wrk, hey, or custom scripts) to saturate the pre-authentication concurrency pool before the server can perform signature verification.
4. Resource exhaustion: The server begins reading request bodies for all concurrent connections simultaneously, exhausting available CPU, memory, or I/O resources and causing the webhook handler to become unresponsive or slow.
5. Service degradation: Legitimate LINE webhook events are dropped or delayed, resulting in transient availability loss for the LINE messaging integration (GitHub Advisory, Fix Commit).

• Network: Sudden spike in concurrent HTTP POST requests to the LINE webhook path (e.g., /line/webhook) from one or multiple source IPs; high volume of requests with no valid LINE X-Line-Signature headers or with malformed/empty bodies.
• Logs: Server access logs showing a large number of simultaneous POST requests to the webhook endpoint within a short time window; elevated error rates or timeouts in OpenClaw application logs related to the LINE webhook handler.
• Process/Resource: Abnormal CPU or memory consumption by the OpenClaw Node.js process coinciding with webhook traffic spikes; increased event loop lag or request queue depth observable via Node.js performance metrics.
• Application: HTTP 503 or timeout responses returned to legitimate LINE platform webhook deliveries during the attack window (GitHub Advisory).

The primary remediation is to upgrade the openclaw npm package to version 2026.3.31 or later, which introduces a shared pre-authentication concurrency budget that rejects excess requests with HTTP 429 before body processing begins (Fix Commit, GitHub Advisory). As a network-level workaround prior to patching, operators should implement rate limiting and concurrency controls on the LINE webhook endpoint at the reverse proxy or WAF layer (e.g., nginx limit_conn, Cloudflare rate limiting) to restrict the number of simultaneous unauthenticated POST requests. Additionally, monitoring webhook endpoint traffic for anomalous concurrent request patterns can provide early warning of exploitation attempts.

The vulnerability was reported by researcher nexrin and sponsored by KeenSecurityLab and qclawer, with the fix authored by vincentkoc (GitHub Advisory). The maintainer assessed the severity as low, noting that the impact is bounded to transient availability loss. A duplicate GitHub Advisory (GHSA-2hv5-4h3g-4hjv) was published and subsequently withdrawn on May 4, 2026, as it duplicated the canonical advisory GHSA-qcc3-jqwp-5vh2 (Duplicate Advisory). No significant broader media coverage or social media discussion has been observed.