PT-2026-26224 · Openclaw+1 · Openclaw+1
Aristore
·
Publicado
2026-02-26
·
Atualizado
2026-03-21
·
CVE-2026-28449
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.2.25
Description
OpenClaw versions prior to 2026.2.25 do not have durable replay state for Nextcloud Talk webhook events. This allows valid signed webhook requests to be replayed without suppression. Attackers can capture and replay previously valid signed webhook requests to trigger duplicate inbound message processing, potentially causing integrity or availability issues. The issue stems from the verification of
HMAC(secret, random + body) without durable replay state tied to webhook events. The fix adds persistent per-account replay deduplication for Nextcloud Talk webhook events, replay checks before webhook side effects, and backend-origin validation. This is an integrity and availability issue scoped to deployments using Nextcloud Talk webhook integration.Recommendations
OpenClaw versions prior to 2026.2.25 should be updated to version 2026.2.25 or later.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Nextcloud Talk
Openclaw