CVE-2026-28449

OpenClaw < 2026.2.25 - Webhook Replay Attack via Missing Durable Replay Suppression

State: Published
Severity: 6.3 Medium
Published: Mar 19, 2026
Updated: Jun 23, 2026
Reserved: Feb 27, 2026

Description

OpenClaw versions prior to 2026.2.25 lack durable replay state for Nextcloud Talk webhook events, allowing valid signed webhook requests to be replayed without suppression. Attackers can capture and replay previously valid signed webhook requests to trigger duplicate inbound message processing and cause integrity or availability issues.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N	VulnCheck
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	VulnCheck

Weaknesses

CWE-294 Authentication Bypass by Capture-replay

Affected Products

Product	Versions
OpenClawOpenClaw	before 2026.2.25Affected

References

GitHub Security Advisory (GHSA-r9q5-c7qc-p26w)vendor-advisory
Patch Commitpatch
VulnCheck Advisory: OpenClaw < 2026.2.25 - Webhook Replay Attack via Missing Durable Replay Suppressionthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.