Medium severity6.5NVD Advisory· Published Mar 19, 2026· Updated Jun 17, 2026

CVE-2026-28449

Description

OpenClaw versions prior to 2026.2.25 lack durable replay state for Nextcloud Talk webhook events, allowing valid signed webhook requests to be replayed without suppression. Attackers can capture and replay previously valid signed webhook requests to trigger duplicate inbound message processing and cause integrity or availability issues.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
openclawnpm	< 2026.2.25	2026.2.25

Affected products

OpenClaw/Openclaw2 versions
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*range: <2026.2.25
- (no CPE)range: 0
ghsa-coords
pkg:npm/openclaw
Range: < 2026.2.25

Patches

Vulnerability mechanics

References

github.com/openclaw/openclaw/commit/d512163d686ad6741783e7119ddb3437f493dbbcnvdPatchWEB
github.com/advisories/GHSA-r9q5-c7qc-p26wghsaADVISORY
github.com/openclaw/openclaw/security/advisories/GHSA-r9q5-c7qc-p26wnvdMitigationVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2026-28449ghsaADVISORY
www.vulncheck.com/advisories/openclaw-webhook-replay-attack-via-missing-durable-replay-suppressionnvdThird Party AdvisoryWEB

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000