Which versions of Nextcloud are affected by CVE-2026-28449?

CVE-2026-28449 presents moderate security risk rated CVSS 6.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-28449?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Nextcloud CVE-2026-28449

Q: What is the CVSS score of CVE-2026-28449?

CVE-2026-28449 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-13011 MEDIUM

Authentication Bypass by Capture-replay (CWE-294)

2026-03-19 VulnCheck

GHSA-r9q5-c7qc-p26w

Information Disclosure Nextcloud

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 01:30 euvd

EUVD-2026-13011

Analysis Generated

Mar 19, 2026 - 01:30 vuln.today

Patch released

Mar 19, 2026 - 01:30 nvd

Patch available

CVE Published

Mar 19, 2026 - 01:00 nvd

MEDIUM 6.3

DescriptionCVE.org

OpenClaw versions prior to 2026.2.25 lack durable replay state for Nextcloud Talk webhook events, allowing valid signed webhook requests to be replayed without suppression. Attackers can capture and replay previously valid signed webhook requests to trigger duplicate inbound message processing and cause integrity or availability issues.

AnalysisAI

OpenClaw versions prior to 2026.2.25 suffer from a webhook replay vulnerability where valid signed Nextcloud Talk webhook requests lack durable replay state suppression, allowing attackers to capture and replay previously legitimate signed requests to trigger duplicate inbound message processing. This can result in message duplication, data integrity issues, and potential availability degradation. While the CVSS score of 4.8 is moderate, the attack requires no authentication and can be executed over the network with medium complexity, making it a viable attack vector for threat actors with network visibility to webhook traffic.

Technical ContextAI

The vulnerability resides in OpenClaw's integration with Nextcloud Talk webhooks (affected products identified via CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*). Webhooks typically use cryptographic signatures to validate authenticity, but without implementing idempotency tokens or durable replay detection mechanisms, an attacker can capture a validly signed webhook payload and resubmit it multiple times. The root cause is classified as CWE-294 (Use of Implicit Authentication), which encompasses failures to implement proper request deduplication or state tracking for signed messages. The technical flaw lies in the assumption that signature validation alone is sufficient for security, when in fact replay protection requires additional mechanisms such as nonce validation, timestamp checking, or distributed replay state caching to prevent the same signed message from being processed twice.

RemediationAI

Immediately upgrade OpenClaw to version 2026.2.25 or later, which includes durable replay state implementation for Nextcloud Talk webhooks (vendor patch committed at https://github.com/openclaw/openclaw/commit/d512163d686ad6741783e7119ddb3437f493dbbc). For organizations unable to patch immediately, implement network-level mitigations including enforced HTTPS/TLS for all webhook communication with certificate pinning, deployment of a Web Application Firewall (WAF) to detect and block repeated identical webhook payloads within short time windows, and restriction of webhook ingestion to trusted Nextcloud Talk server IP ranges via firewall rules. Additionally, implement application-level idempotency by adding request deduplication logic based on webhook payload signatures or message IDs until the official patch is deployed.