CVE-2026-33580

MediumCVSS 6.5

Published: 31/03/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

29th percentile - higher than 29% of all known CVEs

Summary

OpenClaw before 2026.3.28 lacks rate limiting in Nextcloud Talk webhook authentication. Attackers can brute-force weak shared secrets to forge webhook events.

Risk Assessment

An attacker can send forged webhook events, potentially leading to unauthorized actions in the system.

Recommendation

Update OpenClaw to version 2026.3.28 or later.

Original NVD description (English source)

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting authentication without throttling.