Openclaw cli: OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing (CVE-2026-28449)
Description
OpenClaw CLI's Nextcloud Talk webhook integration had a vulnerability where replayed valid signed webhook requests could be accepted multiple times due to lack of durable replay suppression. This could cause duplicate inbound processing, leading to integrity and availability issues such as duplicate actions or noise. The issue affects versions from 2026.1.29 up to but not including 2026.2.25. A fix is available in version 2026.2.25 that adds persistent replay deduplication, replay checks before webhook side effects, and backend-origin validation.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenClaw's Nextcloud Talk webhook path verified requests using HMAC(secret, random + body) but lacked durable replay state tied to webhook events. This allowed replay of previously valid signed requests under certain operational conditions, resulting in duplicate inbound processing after replay-window expiry or process restarts. The patch in version 2026.2.25 introduces persistent per-account replay deduplication, replay checks before webhook side effects, and backend-origin validation against configured account base URLs.
Potential Impact
An attacker or observer who captures a valid signed webhook request could replay it to trigger duplicate processing of the same webhook event. This leads to integrity and availability issues by causing duplicate actions or noise in the system. The impact is scoped to deployments using the Nextcloud Talk webhook integration in OpenClaw CLI.
Mitigation Recommendations
A patch is available in OpenClaw CLI version 2026.2.25 that addresses this vulnerability by adding persistent replay deduplication and validation. Users should upgrade to version 2026.2.25 or later to remediate this issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-28449
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 4.0
Threat ID: 6ac245c912601ec6a3167f17
Added to database: 10/04/2026, 12:25:45 UTC
Last enriched: 10/04/2026, 13:11:07 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.