Executive brief
OpenClaw is a JavaScript library used to integrate Nextcloud Talk webhooks with external systems. The webhook authentication uses a shared secret that operators configure. Without rate limiting on failed authentication attempts, attackers can repeatedly try weak shared secrets to forge fake webhook messages, potentially injecting malicious events into Nextcloud Talk workflows.
Technical details
This is a missing rate limiting vulnerability (CWE-307) in the Nextcloud Talk webhook authentication mechanism within OpenClaw's extensions/nextcloud-talk/src/monitor.ts component. The webhook endpoint accepts authentication via a shared secret but does not throttle repeated failed authentication attempts, allowing attackers with network access to the webhook to brute-force weak shared secrets online without being locked out or delayed. An attacker who recovers the shared secret can then forge and inject arbitrary webhook events into the Nextcloud Talk integration. The vulnerability affects all versions prior to 2026.3.28, which was patched by commit e403decb6e to throttle repeated webhook authentication failures.
Affected products
- OpenClaw OpenClaw before 2026.3.28
Timeline
- 2026-03-29: disclosed
- 2026-03-28: patched: Version 2026.3.28 released with fix