CVE-2026-33580

Published: Mar 31, 2026 Last Modified: Mar 31, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,3
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
CRITICAL 9,8
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting authentication without throttling.

307

Improper Restriction of Excessive Authentication Attempts

Draft
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/openclaw/openclaw/commit/e403decb6e20091b5402780a7ccd2085f98…
https://github.com/openclaw/openclaw/security/advisories/GHSA-9528-x887-j2fp
https://www.vulncheck.com/advisories/openclaw-brute-force-attack-via-missing-ra…