CVE-2026-41346: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41346 is a denial-of-service vulnerability in OpenClaw (npm package) caused by improper control of interaction frequency in the pairing request subsystem. Affected versions are 2026.2.26 through 2026.3.30 (i.e., before 2026.3.31); the vulnerability was published on April 23, 2026 and assigned by VulnCheck. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-799 (Improper Control of Interaction Frequency): OpenClaw's pairing-store.ts enforced the PAIRING_PENDING_MAX cap on pending pairing requests at the channel-file level rather than per account. In multi-account channel configurations, the shared pending window could be exhausted by requests originating from any account, not just the targeted one. An unauthenticated remote attacker with network access can submit pairing requests from controlled or attacker-owned accounts to fill the shared queue, preventing legitimate accounts from initiating new pairing challenges. The fix, committed as 9bc1f896c8cd325dd4761681e9bdb8c425f69785, replaced the global pruneExcessRequests function with pruneExcessRequestsByAccount, which groups and caps pending requests independently per account (GitHub Commit, GitHub Advisory).

Exploitation results in an availability-only denial of service: legitimate users are blocked from initiating new pairing or onboarding on their accounts until existing attacker-submitted requests are approved or expire. There is no impact on confidentiality or integrity — the vulnerability does not permit cross-account approval, data access, or authorization bypass. The scope is limited to the pairing authentication mechanism of affected OpenClaw instances running in multi-account channel configurations (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.095%, indicating a low probability of exploitation in the near term. Exploitation requires the presence of a multi-account channel setup (Attack Requirements: Present in CVSS v4.0), but no privileges or user interaction are needed from the attacker's side (Feedly).

1. Identify target: Locate an OpenClaw instance (npm package versions 2026.2.26–2026.3.30) configured with a multi-account channel setup where multiple accounts share a single channel file.
2. Obtain or create attacker-controlled accounts: Register or use existing accounts on the target OpenClaw channel that are separate from the victim account.
3. Flood the pending pairing queue: Submit the maximum allowed number of pairing requests (PAIRING_PENDING_MAX) from attacker-controlled accounts to the shared channel, exhausting the global pending window stored in the channel file.
4. Block legitimate pairing: Once the shared pending window is full, any new pairing challenge submitted by the legitimate (victim) account is rejected, as the cap check operates on the total channel-file queue rather than per-account counts.
5. Sustain the denial of service: Continuously refresh or re-submit requests before they expire to maintain the blocked state, preventing the victim account from completing pairing or onboarding until the attacker stops or the patch is applied (GitHub Advisory, GitHub Commit).

• Logs: Unusually high volume of pairing request submissions from multiple distinct account IDs to the same channel within a short time window; repeated rejection messages for legitimate account pairing attempts in OpenClaw application logs.
• File System: The channel pairing state file (e.g., <stateDir>/<channel>-pairing.json) containing a large number of pending requests all attributed to non-default or unfamiliar account IDs, with the requests array at or near PAIRING_PENDING_MAX.
• Application Behavior: Legitimate users consistently unable to initiate new pairing challenges on a specific channel despite the service being otherwise operational; pairing requests from known-good accounts returning a created: false response.

Update the OpenClaw npm package to version 2026.3.31 or later (the current published release as of the advisory is 2026.4.1, which also contains the fix). The patch scopes pending pairing-request caps per account rather than per shared channel file, eliminating the exhaustion vector. No configuration-based workaround is documented; upgrading is the only recommended remediation (GitHub Advisory, GitHub Commit).

The vulnerability was reported by researcher smaeljaish771 and sponsored by KeenSecurityLab, with the fix authored by vincentkoc. The original GitHub Security Advisory (GHSA-wwfp-w96m-c6x8) was published by maintainer steipete and rated Low severity by the project. A duplicate advisory (GHSA-mf69-r24q-ghhr) was published to the GitHub Advisory Database on April 24, 2026 and subsequently withdrawn on May 4, 2026 as a duplicate. No broader media coverage or notable community discussion has been identified (GitHub Advisory, Feedly).