CVE-2026-28449CWE-294

OpenClaw < 2026.2.25 - Webhook Replay Attack via Missing Durable Replay Suppression

Medium · published March 19, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
41.0
In the wild
Unconfirmed
What it is

OpenClaw versions prior to 2026.2.25 lack durable replay state for Nextcloud Talk webhook events, allowing valid signed webhook requests to be replayed without suppression. Attackers can capture and replay previously valid signed webhook requests to trigger duplicate inbound message processing and cause integrity or availability issues.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00488 · 41.0th percentile
Weakness
CWE-294 · Authentication Bypass by Capture-replay
Published
2026-03-19T01:00Z
EPSS history
Timeline
  • 19 MAR 01:00Z
    OpenClaw < 2026.2.25 - Webhook Replay Attack via Missing Durable Replay Suppression
    cvelistv5