GHSA-mf5g-6r6f-ghhm: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

Summary

Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Weak Webhook Token

Affected Packages / Versions

• Package: openclaw
• Affected versions: <= 2026.3.24
• First patched version: 2026.3.25
• Latest published npm version at verification time: 2026.3.24

Details

Synology Chat webhook auth previously rejected invalid tokens without throttling repeated guesses, allowing brute-force attempts against weak webhook secrets. Commit 0b4d07337467f4d40a0cc1ced83d45ceaec0863c adds repeated-guess throttling before auth failure responses. Verified vulnerable on tag v2026.3.24 and fixed on main by commit 0b4d07337467f4d40a0cc1ced83d45ceaec0863c.

Fix Commit(s)

• 0b4d07337467f4d40a0cc1ced83d45ceaec0863c