What is the CVSS score of CVE-2026-32012?

CVE-2026-32012 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L.

Which versions of Nextcloud are affected by CVE-2026-32012?

CVE-2026-32012 presents moderate security risk rated CVSS 4.8. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-32012?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Nextcloud CVE-2026-32012

EUVD-2026-14563 MEDIUM

Authentication Bypass by Capture-replay (CWE-294)

2026-03-23 VulnCheck

GHSA-ffxm-98hg-x985

Information Disclosure Nextcloud

4.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 22:00 euvd

EUVD-2026-14563

Analysis Generated

Mar 23, 2026 - 22:00 vuln.today

Patch released

Mar 23, 2026 - 22:00 nvd

Patch available

CVE Published

Mar 23, 2026 - 21:36 nvd

MEDIUM 4.8

DescriptionCVE.org

OpenClaw before 2026.2.25 lacks durable replay state for Nextcloud Talk webhook events, allowing valid signed requests to be replayed. Attackers can capture and replay previously valid signed webhook requests to trigger duplicate inbound processing and cause integrity or availability issues.

AnalysisAI

OpenClaw before version 2026.2.25 fails to implement durable replay state validation for Nextcloud Talk webhook events, allowing attackers to capture and replay previously valid signed webhook requests to cause duplicate processing. This affects all versions of OpenClaw prior to the patched release, and an attacker with network access can exploit this vulnerability without authentication or user interaction to trigger integrity and availability impacts such as duplicate message processing or resource exhaustion.

Technical ContextAI

The vulnerability exists in OpenClaw's webhook handling mechanism for Nextcloud Talk integrations, specifically in the absence of cryptographic replay protection mechanisms (CWE-294: Improper Handling of Insufficient Cryptographic Entropy). While webhook requests are cryptographically signed to verify origin, the application lacks a durable replay state store (such as a nonce cache, timestamp validation window, or idempotency key tracking) to prevent the same signed payload from being processed multiple times. This is a protocol-level design flaw rather than a cryptographic weakness—the signatures themselves are valid; the problem is that valid signatures are treated as sufficient proof of authenticity without considering whether the exact same request has already been processed. The affected product is OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*), a webhook integration platform for Nextcloud Talk.

RemediationAI

Upgrade OpenClaw to version 2026.2.25 or later immediately, which includes fixes to implement durable replay state validation for webhook events. The patched commit (d512163d686ad6741783e7119ddb3437f493dbbc) is available on the OpenClaw GitHub repository. Until patching is completed, implement network-level mitigations including: restrict webhook ingestion to trusted Nextcloud Talk server IP ranges using firewall rules; enforce TLS 1.2 or higher for all webhook transport; monitor webhook processing logs for anomalous duplicate activity patterns; and consider implementing a temporary reverse proxy with request deduplication based on cryptographic request fingerprinting (hash of signature plus timestamp). See the vendor advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-r9q5-c7qc-p26w for complete remediation guidance.