Cyber Posture

CVE-2026-41399

HighPublic PoC

Published: 28 April 2026

Published
28 April 2026
Modified
30 April 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0007 21.6th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-41399 is a high-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Openclaw Openclaw. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Service Exhaustion Flood (T1499.002); ranked at the 21.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-10 (Concurrent Session Control) and SC-5 (Denial-of-service Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Service Exhaustion Flood (T1499.002). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly protects against denial-of-service attacks via unbounded concurrent unauthenticated WebSocket upgrades that exhaust socket and worker capacity.

prevent

Enforces resource allocation limits and protections to prevent exhaustion of sockets and workers by unauthenticated WebSocket connections.

prevent

Limits concurrent sessions or connections, mitigating unbounded WebSocket upgrades that disrupt availability for legitimate clients.

MITRE ATT&CK Enterprise TechniquesAI

T1499.002 Service Exhaustion Flood Impact
Adversaries may target the different network services provided by systems to conduct a denial of service (DoS).
Why these techniques?

The vulnerability enables flooding the service with excessive unauthenticated WebSocket upgrade requests to exhaust socket/worker resources, directly facilitating a Service Exhaustion Flood (T1499.002) for denial-of-service.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

OpenClaw before 2026.3.28 accepts unbounded concurrent unauthenticated WebSocket upgrades without pre-authentication budget allocation. Unauthenticated network attackers can exhaust socket and worker capacity to disrupt WebSocket availability for legitimate clients.

Deeper analysisAI

CVE-2026-41399 affects OpenClaw versions prior to 2026.3.28, where the software accepts unbounded concurrent unauthenticated WebSocket upgrades without pre-authentication budget allocation. This flaw, classified under CWE-770 (Allocation of Resources Without Limits or Throttling), enables resource exhaustion attacks. The vulnerability received a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and was published on 2026-04-28.

Unauthenticated network attackers can exploit this issue with low complexity and no privileges required. By initiating excessive WebSocket upgrade requests, they can exhaust socket and worker capacity, resulting in a denial-of-service that disrupts WebSocket availability for legitimate clients.

Advisories detailing mitigation are available from the OpenClaw GitHub security page at https://github.com/openclaw/openclaw/security/advisories/GHSA-f44p-c7w9-7xr7 and VulnCheck at https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-unbounded-pre-auth-websocket-upgrades.

Details

CWE(s)

Affected Products

openclaw
openclaw
≤ 2026.3.28

CVEs Like This One

CVE-2026-32980Same product: Openclaw Openclaw
CVE-2026-28461Same product: Openclaw Openclaw
CVE-2026-29609Same product: Openclaw Openclaw
CVE-2026-28478Same product: Openclaw Openclaw
CVE-2026-32062Same product: Openclaw Openclaw
CVE-2026-29612Same product: Openclaw Openclaw
CVE-2026-32011Same product: Openclaw Openclaw
CVE-2026-32049Same product: Openclaw Openclaw
CVE-2026-41400Same product: Openclaw Openclaw
CVE-2026-43569Same product: Openclaw Openclaw

References