| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| openclaw | < 2026.3.28 | 2026.3.28 |
| openclaw | < 2026.3.28 | 2026.3.28 |
Nextcloud Talk webhook signature failures were not throttled even though the integration relies on an operator-configured shared secret that may be weak.
An attacker who could reach the webhook endpoint could brute-force weak secrets online and then forge inbound webhook events.
extensions/nextcloud-talk/src/monitor.ts
<= 2026.3.24>= 2026.3.282026.3.28 contains the fix.Fixed by commit e403decb6e (nextcloud-talk: throttle repeated webhook auth failures).
OpenClaw thanks @AntAISecurityLab for reporting.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí