CVE-2026-33580 in OpenClaw
Sumário (Inglês)
OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting authentication without throttling.
Responsável
VulnCheck
Reservar
23/03/2026
Divulgação
31/03/2026
Inscrições
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerabilidade | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 354396 | OpenClaw Webhook Divulgação de Informação | 307 | Não definido | Correção oficial | CVE-2026-33580 |