CVE-2026-33580: OpenClaw webhook brute-force

CISO Take

OpenClaw's Nextcloud Talk webhook integration omits rate limiting on shared-secret authentication, allowing any unauthenticated attacker reachable to the endpoint to brute-force the secret and inject forged webhook events into the AI agent pipeline. With no privileges required, low attack complexity, and an EPSS placing this CVE in the top 72% for exploitation likelihood, the barrier to abuse is low despite the absence of a public exploit or KEV listing. OpenClaw functions as an AI agent orchestrator with 4 known downstream dependents, meaning forged events can silently redirect agent actions, trigger unintended tool calls, or manipulate automated workflows without the agent runtime detecting the tamper. Teams should patch to 2026.3.28 immediately; if patching is delayed, restrict webhook endpoint access to trusted source IPs via firewall or reverse-proxy ACL and rotate to a high-entropy shared secret (32+ random bytes).

Sources: NVD EPSS GitHub Advisory ATLAS VulnCheck

What is the risk?

Medium risk with above-average exploitability. The vulnerability requires zero authentication and minimal skill — brute-forcing an HTTP endpoint is scriptable in minutes. The EPSS of 0.00365 (top 72nd percentile) reflects that missing rate-limiting on authentication is a frequently weaponized pattern. Impact is bounded to confidentiality-low and integrity-low per CVSS, but in an AI agent context integrity compromise is more dangerous than the score implies: forged events mean the agent acts on attacker-controlled input, potentially amplifying blast radius through downstream tool invocations. No active exploitation or KEV listing keeps overall risk at medium rather than high, but the trivial exploitation path warrants prompt remediation.

How does the attack unfold?

Reconnaissance

Attacker scans for publicly exposed OpenClaw webhook endpoints by probing known paths associated with Nextcloud Talk integrations.

AML.T0006

Credential Brute-Force

With no rate limiting in place, attacker scripts thousands of authentication attempts per minute against the webhook endpoint, cycling through candidate shared secrets until one succeeds.

AML.T0049

Event Forgery

Using the recovered shared secret, attacker crafts and submits forged Nextcloud Talk webhook payloads that OpenClaw processes as legitimate messages from trusted users.

AML.T0080

Unauthorized Agent Action

OpenClaw's AI agent executes the instructions embedded in the forged events — invoking connected tools, exfiltrating data, or injecting adversarial instructions into ongoing agent tasks.

AML.T0053

Reconnaissance

Attacker scans for publicly exposed OpenClaw webhook endpoints by probing known paths associated with Nextcloud Talk integrations.

AML.T0006

Credential Brute-Force

With no rate limiting in place, attacker scripts thousands of authentication attempts per minute against the webhook endpoint, cycling through candidate shared secrets until one succeeds.

AML.T0049

Event Forgery

Using the recovered shared secret, attacker crafts and submits forged Nextcloud Talk webhook payloads that OpenClaw processes as legitimate messages from trusted users.

AML.T0080

Unauthorized Agent Action

OpenClaw's AI agent executes the instructions embedded in the forged events — invoking connected tools, exfiltrating data, or injecting adversarial instructions into ongoing agent tasks.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C Low

I Low

A None

What should I do?

5 steps

Patch: upgrade OpenClaw to 2026.3.28 or later (commit e403decb introduces rate limiting on webhook authentication).
Network control: if immediate patching is not possible, restrict the webhook endpoint to known Nextcloud Talk source IPs at the firewall or reverse-proxy level.
Secret rotation: replace any existing shared secret with a cryptographically random value of at least 32 bytes; short or guessable secrets are the primary attack surface.
Detection: alert on >10 failed webhook authentication attempts per minute from a single source IP; webhook auth failures should be logged with source IP and timestamp.
Audit: review webhook event logs for anomalous event types or payloads that do not match expected Nextcloud Talk message schemas.

How is it classified?

Auth Bypass Code Execution Agent API AML.T0006 - Active Scanning AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0080 - AI Agent Context Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.1.3 - Access Control for AI Systems

NIST AI RMF

MANAGE 2.2 - Risk Response

OWASP LLM Top 10

LLM05 - Insecure Plugin Design LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-33580?

OpenClaw's Nextcloud Talk webhook integration omits rate limiting on shared-secret authentication, allowing any unauthenticated attacker reachable to the endpoint to brute-force the secret and inject forged webhook events into the AI agent pipeline. With no privileges required, low attack complexity, and an EPSS placing this CVE in the top 72% for exploitation likelihood, the barrier to abuse is low despite the absence of a public exploit or KEV listing. OpenClaw functions as an AI agent orchestrator with 4 known downstream dependents, meaning forged events can silently redirect agent actions, trigger unintended tool calls, or manipulate automated workflows without the agent runtime detecting the tamper. Teams should patch to 2026.3.28 immediately; if patching is delayed, restrict webhook endpoint access to trusted source IPs via firewall or reverse-proxy ACL and rotate to a high-entropy shared secret (32+ random bytes).

Is CVE-2026-33580 actively exploited?

No confirmed active exploitation of CVE-2026-33580 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-33580?

1. Patch: upgrade OpenClaw to 2026.3.28 or later (commit e403decb introduces rate limiting on webhook authentication). 2. Network control: if immediate patching is not possible, restrict the webhook endpoint to known Nextcloud Talk source IPs at the firewall or reverse-proxy level. 3. Secret rotation: replace any existing shared secret with a cryptographically random value of at least 32 bytes; short or guessable secrets are the primary attack surface. 4. Detection: alert on >10 failed webhook authentication attempts per minute from a single source IP; webhook auth failures should be logged with source IP and timestamp. 5. Audit: review webhook event logs for anomalous event types or payloads that do not match expected Nextcloud Talk message schemas.

What systems are affected by CVE-2026-33580?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, event-driven AI pipelines, webhook-integrated agent runtimes, multi-tool AI orchestration systems.

What is the CVSS score for CVE-2026-33580?

CVE-2026-33580 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

agent frameworksevent-driven AI pipelineswebhook-integrated agent runtimesmulti-tool AI orchestration systems

MITRE ATLAS Techniques

AML.T0006 Active Scanning

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0080 AI Agent Context Poisoning

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.1.3

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM05, LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting authentication without throttling.

Exploitation Scenario

An attacker discovers an internet-exposed OpenClaw instance by scanning for the Nextcloud Talk webhook path (e.g., /webhook/nextcloud-talk). They write a simple script to POST authentication requests cycling through candidate shared secrets — dictionary words, short strings, or leaked values from GitHub. Without rate limiting or lockout, thousands of attempts per minute are possible. Once the correct secret is identified, the attacker crafts a forged Nextcloud Talk webhook payload mimicking a trusted user message. OpenClaw processes this as a legitimate instruction and the embedded AI agent executes the encoded command: retrieving internal documents, invoking connected APIs, or relaying sensitive agent memory to an attacker-controlled endpoint.

Weaknesses (CWE)

CWE-307 Improper Restriction of Excessive Authentication Attempts

CWE-307 — Improper Restriction of Excessive Authentication Attempts: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

[Architecture and Design] Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

Source: MITRE CWE corpus.