cve.bz

CVE-2026-33580

6.3 mediumEPSS 0.4%

Medium (6.3) in openclaw openclaw. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in openclaw 2026.3.28.

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting authentication without throttling.

Severity

CVSS 4.0

6.3 medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.5 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
CWE
CWE-307
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-9528-x887-j2fpnpmopenclaw<2026.3.282026.3.28

References

Check your stackJSON