PT-2026-27226 · Openclaw · Openclaw

Aristore · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-32012

NVD

CVSS v3.1

4.8

Medium

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

OpenClaw before 2026.2.25 lacks durable replay state for Nextcloud Talk webhook events, allowing valid signed requests to be replayed. Attackers can capture and replay previously valid signed webhook requests to trigger duplicate inbound processing and cause integrity or availability issues.

Fix

Weakness Enumeration

CWE-294

Related Identifiers

CVE-2026-32012

Affected Products

Openclaw

References · 4

• https://github.com/openclaw/openclaw/commit/d512163d686ad6741783e7119ddb3437f493dbbc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32012 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-r9q5-c7qc-p26w · Note
• https://vulncheck.com/advisories/openclaw-mar-webhook-replay-attack-via-missing-durable-replay-suppression · Note