| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.3.28 | 2026.3.28 |
| openclaw | < 2026.3.28 | 2026.3.28 |
Nextcloud Talk webhook signature failures were not throttled even though the integration relies on an operator-configured shared secret that may be weak.
An attacker who could reach the webhook endpoint could brute-force weak secrets online and then forge inbound webhook events.
extensions/nextcloud-talk/src/monitor.ts
<= 2026.3.24>= 2026.3.282026.3.28 contains the fix.Fixed by commit e403decb6e (nextcloud-talk: throttle repeated webhook auth failures).
OpenClaw thanks @AntAISecurityLab for reporting.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free