Harjothkhara

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions 2026.6.6 through 2026.8.0 **Description** The SMS webhook applies the invalid-request rate limit before performing Twilio signature verification and identifies clients solely by the raw proxy socket address. In environments where the webhook is behind a trusted reverse proxy or tunnel, multiple external clients share a single socket address. This allows an unauthenticated remote sender to exhaust the shared pre-authentication rate-limit budget by sending invalid requests, leading to HTTP 429 responses for legitimate, correctly signed Twilio callbacks. This results in a temporary loss of inbound SMS messages, although the attacker cannot forge callbacks or access message data. **Recommendations** Update OpenClaw to version 2026.8.1.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions 2026.3.25 through 2026.8.0 **Description** Invalid-token rate limiting for Synology Chat webhooks is applied before authentication and is keyed on the raw proxy socket address. In environments where the software is positioned behind a trusted reverse proxy or tunnel, multiple external clients may share a single socket address. This allows an unauthenticated sender to exhaust the shared invalid-token budget, resulting in the rejection of legitimate Synology Chat webhook callbacks until the rate-limit window expires. This leads to a temporary loss of channel availability, although the attacker cannot obtain valid tokens or access message data. **Recommendations** Update OpenClaw to version 2026.8.1.