CVE-2026-33580CWE-307

OpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret Authentication

Medium · published March 31, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting authentication without throttling.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00427 · 35.9th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2026-03-31T14:10Z
EPSS history
Timeline
  • 31 MAR 14:10Z
    OpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret Authentication
    cvelistv5