CVE-2026-33580 — OpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret Authentication

Affected: OpenClaw

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting authentication without throttling.

GHSA-9528-x887-j2fp — OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication

Affected: npm: openclaw

## Summary

Nextcloud Talk webhook signature failures were not throttled even though the integration relies on an operator-configured shared secret that may be weak.

## Impact

An attacker who could reach the webhook endpoint could brute-force weak secrets online and then forge inbound webhook events.

## Affected Component

`extensions/nextcloud-talk/src/monitor.ts`

## Fixed Versions

- Affected: `<= 2026.3.24` - Patched: `>= 2026.3.28` - Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `e403decb6e` (`nextcloud-talk: throttle repeated webhook auth failures`).

OpenClaw thanks @AntAISecurityLab for reporting.

Most recent entries from all

CVE-2026-33580 — OpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret Authentication

GHSA-9528-x887-j2fp — OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication