Executive brief
OpenClaw is an integration tool that connects Nextcloud Talk messaging with other systems via webhooks. A design flaw allows attackers to capture and replay previously valid webhook messages, causing duplicate message processing. This could lead to duplicate actions, data corruption, or service disruption for organizations using Nextcloud Talk integration.
Technical details
OpenClaw validates Nextcloud Talk webhook requests using HMAC-SHA256 signature verification but lacks persistent replay suppression state, allowing previously captured valid signed webhook requests to be replayed. The vulnerability is a capture-replay flaw (CWE-294) where an attacker with network access can intercept a valid webhook event and send it again to trigger duplicate inbound message processing. Replay checks were not persisted across process restarts or past the replay time window, making the attack viable in production environments. The fix (released in version 2026.2.25) implements persistent per-account replay deduplication, validates webhook origin against the configured Nextcloud base URL, and performs replay checks before webhook side effects. All versions prior to 2026.2.25 are affected.
Affected products
- OpenClaw openclaw <=2026.2.24
Timeline
- 2026-02-26: disclosed
- 2026-02-26: patched: Version 2026.2.25