Executive brief
OpenClaw, a library used for integrations, contains a security flaw in its Nextcloud Talk webhook component. This flaw allows an attacker to repeatedly guess the secret password used to verify incoming messages because the system does not slow down or block failed attempts. If successful, an attacker could send fake messages or commands to the system, potentially disrupting operations or triggering unauthorized actions.
Technical details
A missing rate limiting vulnerability (CWE-307) exists in the Nextcloud Talk webhook authentication within OpenClaw versions prior to 2026.3.28. The root cause is located in 'extensions/nextcloud-talk/src/monitor.ts', where signature failures were not throttled. An unauthenticated remote attacker can reach the webhook endpoint and perform a brute-force attack against the operator-configured shared secret. Successful exploitation allows the attacker to forge inbound webhook events. The issue is resolved in version 2026.3.28 by implementing throttling for repeated authentication failures.
Affected products
- OpenClaw OpenClaw < 2026.3.28
Timeline
- 2026-03-29: advisory: GitHub Security Advisory GHSA-9528-x887-j2fp published
- 2026-03-31: disclosed: CVE-2026-33580 published
- 2026-03-28: patched: Version 2026.3.28 released with fix