CVE-2026-28449

Опубликовано: 19 мар. 2026

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

OpenClaw versions prior to 2026.2.25 lack durable replay state for Nextcloud Talk webhook events, allowing valid signed webhook requests to be replayed without suppression. Attackers can capture and replay previously valid signed webhook requests to trigger duplicate inbound message processing and cause integrity or availability issues.

Ссылки

https://github.com/openclaw/openclaw/commit/d512163d686ad6741783e7119ddb3437f493dbbc
Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-r9q5-c7qc-p26w
Mitigation
Vendor Advisory
https://www.vulncheck.com/advisories/openclaw-webhook-replay-attack-via-missing-durable-replay-suppression
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

Версия до 2026.2.25 (исключая)

EPSS

Процентиль: 19%

0.00267

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-294

Связанные уязвимости

GHSA-r9q5-c7qc-p26w

github

5 месяцев назад

OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing

BDU:2026-05022