PT-2026-26224 · Openclaw+1 · Openclaw+1
Aristore
·
Published
2026-02-26
·
Updated
2026-03-21
·
CVE-2026-28449
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.2.25
Description
OpenClaw versions prior to 2026.2.25 do not have durable replay state for Nextcloud Talk webhook events. This allows valid signed webhook requests to be replayed without suppression. Attackers can capture and replay previously valid signed webhook requests to trigger duplicate inbound message processing, potentially causing integrity or availability issues. The issue stems from the verification of
HMAC(secret, random + body) without durable replay state tied to webhook events. The fix adds persistent per-account replay deduplication for Nextcloud Talk webhook events, replay checks before webhook side effects, and backend-origin validation. This is an integrity and availability issue scoped to deployments using Nextcloud Talk webhook integration.Recommendations
OpenClaw versions prior to 2026.2.25 should be updated to version 2026.2.25 or later.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nextcloud Talk
Openclaw