PT-2026-29260 · Unknown+1 · Nextcloud Talk+1

Antaisecuritylab

·

Published

2026-03-31

·

Updated

2026-03-31

·

CVE-2026-33580

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.28
Description OpenClaw is affected by a missing rate limiting issue in the Nextcloud Talk webhook authentication. This allows attackers to attempt to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting authentication without throttling. The vulnerability impacts the authentication process for webhooks related to Nextcloud Talk. The webhook endpoint is susceptible to repeated authentication attempts. The shared secret used for authentication, shared secret, is vulnerable to brute-force attacks due to the lack of rate limiting.
Recommendations Update OpenClaw to version 2026.3.28 or later.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2026-33580
GHSA-9528-X887-J2FP
GHSA-GM9M-X74R-8WHG

Affected Products

Nextcloud Talk
Openclaw