PT-2026-29260 · Openclaw · Openclaw

Antaisecuritylab · Published 2026-03-31 · Updated 2026-03-31 · CVE-2026-33580

Mitre

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting authentication without throttling.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2026-33580

Affected Products

Openclaw

References · 4

• https://github.com/openclaw/openclaw/commit/e403decb6e20091b5402780a7ccd2085f98aa3cd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33580 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-9528-x887-j2fp · Note
• https://vulncheck.com/advisories/openclaw-brute-force-attack-via-missing-rate-limiting-on-webhook-shared-secret-authentication · Note