CVE-2026-33580 in OpenClaw
摘要 (英语)
OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting authentication without throttling.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
负责
VulnCheck
预定
2026-03-23
披露
2026-03-31
状态
已确认
条目
VulDB provides additional information and datapoints for this CVE:
| 标识符 | 漏洞 | CWE | 可利用 | 对策 | CVE |
|---|---|---|---|---|---|
| 354396 | OpenClaw Webhook 信息公开 | 307 | 未定义 | 官方修复 | CVE-2026-33580 |