Which versions of Openclaw are affected by EUVD-2026-17439?

OpenClaw versions prior to 2026.3.28 contain a critical brute-force vulnerability in webhook authentication that allows unauthenticated remote attackers to forge Nextcloud Talk webhook events and…. A patch is available.

How to fix or mitigate EUVD-2026-17439?

Within 24 hours: Inventory all OpenClaw deployments and identify instances running versions prior to 2026.3.28. Within 7 days: Apply vendor-released patch (commit e403decb6e20091b5402780a7ccd2085f98aa3cd or newer, upgrading to version 2026.3.28 or later). Verify patch application across all production and non-production environments. Within 30 days: Audit webhook configurations for suspicious activity, review shared secret strength, and implement network-level rate limiting if available as defense-in-depth measure.

Openclaw EUVD-2026-17439

Q: What is the CVSS score of EUVD-2026-17439?

EUVD-2026-17439 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-33580 MEDIUM

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-03-31 VulnCheck

Information Disclosure Openclaw

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 14:30 euvd

EUVD-2026-17439

Analysis Generated

Mar 31, 2026 - 14:30 vuln.today

Patch released

Mar 31, 2026 - 14:30 nvd

Patch available

CVE Published

Mar 31, 2026 - 14:10 nvd

MEDIUM 6.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on openclaw (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.3.28.

DescriptionCVE.org

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting authentication without throttling.

AnalysisAI

Brute-force attacks against OpenClaw webhook authentication allow unauthenticated remote attackers to forge Nextcloud Talk webhook events by exploiting missing rate limiting on shared secret validation. Affecting OpenClaw versions prior to 2026.3.28, attackers can repeatedly attempt authentication without throttling to compromise weak shared secrets and inject malicious webhook payloads. CVSS 9.8 critical severity reflects network-accessible attack surface requiring no authentication. No public exploit identified at time of analysis, though EPSS data not available. Vendor-released patch available via commit e403decb6e20091b5402780a7ccd2085f98aa3cd.

Technical ContextAI

OpenClaw is an integration platform connecting external services with Nextcloud Talk via webhooks. The vulnerability stems from CWE-307 (Improper Restriction of Excessive Authentication Attempts) in the webhook authentication mechanism. Webhook endpoints typically validate inbound requests using shared secrets-cryptographic tokens that must match between the sender and receiver. Without rate limiting, attackers can automate unlimited authentication attempts against the webhook endpoint to brute-force weak or short shared secrets. The CVSS vector AV:N (network attack vector) indicates the webhook endpoint is internet-accessible, while PR:N (no privileges required) confirms attackers need no prior authentication to OpenClaw itself. Once the shared secret is compromised, attackers can craft forged webhook events that OpenClaw will process as legitimate Nextcloud Talk messages, enabling message injection, data manipulation, or triggering unintended automation workflows. The CPE string cpe:2.3:a:openclaw:openclaw identifies the affected product as the OpenClaw application itself, with the wildcard version indicating all releases prior to the patched version are vulnerable.

RemediationAI

Upgrade to OpenClaw version 2026.3.28 or later, which includes the patch addressing missing rate limiting in webhook authentication. The upstream fix is available via commit e403decb6e20091b5402780a7ccd2085f98aa3cd at https://github.com/openclaw/openclaw/commit/e403decb6e20091b5402780a7ccd2085f98aa3cd, which implements rate limiting controls on shared secret validation attempts. Organizations unable to immediately patch should implement compensating controls including restricting webhook endpoint access to trusted IP ranges via firewall rules or reverse proxy ACLs, rotating existing shared secrets to cryptographically strong random values (minimum 32 characters from secure random source), and monitoring webhook authentication logs for repeated failed attempts indicating active brute-force activity. Deploy intrusion detection signatures to alert on abnormal request volumes to webhook endpoints. Review the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-9528-x887-j2fp for additional configuration hardening guidance and validation testing procedures to confirm patch effectiveness post-deployment.