PT-2026-26224 · Openclaw+1 · Openclaw+1

Aristore

·

Publicado

2026-02-26

·

Atualizado

2026-03-21

·

CVE-2026-28449

CVSS v3.1

6.5

Média

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.25
Description OpenClaw versions prior to 2026.2.25 do not have durable replay state for Nextcloud Talk webhook events. This allows valid signed webhook requests to be replayed without suppression. Attackers can capture and replay previously valid signed webhook requests to trigger duplicate inbound message processing, potentially causing integrity or availability issues. The issue stems from the verification of HMAC(secret, random + body) without durable replay state tied to webhook events. The fix adds persistent per-account replay deduplication for Nextcloud Talk webhook events, replay checks before webhook side effects, and backend-origin validation. This is an integrity and availability issue scoped to deployments using Nextcloud Talk webhook integration.
Recommendations OpenClaw versions prior to 2026.2.25 should be updated to version 2026.2.25 or later.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

Enumeração de Fraquezas

Identificadores relacionados

BDU:2026-05022
CVE-2026-28449
GHSA-866C-WWM5-4RJ7
GHSA-R9Q5-C7QC-P26W

Produtos afetados

Nextcloud Talk
Openclaw