A vulnerability in OpenClaw allows unauthenticated attackers to trigger a denial of service through resource exhaustion via manipulated MS Teams webhook requests.

The application incorrectly orders its request processing, parsing MS Teams webhook bodies prior to performing necessary JWT authentication checks. This flaw allows unauthenticated remote attackers to send specially crafted payloads that exhaust server resources.

The exploitation of this vulnerability can lead to significant denial of service, rendering the application unavailable to legitimate users. With a CVSS score of 7.5, the risk is elevated because the attack is network-exploitable and requires no authentication, potentially resulting in operational disruption and service downtime for organizations relying on this integration.

Immediate Action: Update the OpenClaw package to version 2026.3.31 or later, as provided in the npm repository, to ensure proper authentication order is enforced.

Proactive Monitoring: Monitor server CPU and memory utilization logs for sudden, anomalous spikes associated with incoming webhook traffic.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an API gateway to perform request validation and rate limiting before the traffic reaches the vulnerable application logic.

Public Exploit Available: No (exploit_available: unknown)

Given the ease of exploitation, this vulnerability poses a clear risk to service availability. Organizations should prioritize updating their instances to the patched version immediately to prevent potential denial of service attacks. If an immediate update is not feasible, implement strict rate limiting and filtering on the webhook endpoint to mitigate the impact.