CVE-2026-33580

תיאור (מקור, אנגלית)

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting authentication without throttling.

מדדים

CVSS 3.1

6.5 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CVSS 4.0

6.3 (MEDIUM) מקור הציון: CNA CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-26/7/2026

CWE

CWE-307

מוצרים מושפעים

openclaw: openclaw

קישורים

• https://github.com/openclaw/openclaw/security/advisories/GHSA-9528-x887-j2fp Vendor Advisory
• https://github.com/openclaw/openclaw/commit/e403decb6e20091b5402780a7ccd2085f9‮… Patch
• https://www.vulncheck.com/advisories/openclaw-brute-force-attack-via-missing-r‮… Third Party Advisory