OpenClaw before version 2026.3.28 lacks rate limiting on the Nextcloud Talk webhook authentication. This missing guard allows an attacker to repeatedly try different shared secrets until the correct one is found. When the secret is guessed, the attacker can forge webhook events, essentially sending unauthorized payloads into the system and potentially triggering unintended actions.

Vulnerable installations are any OpenClaw deployments running a version earlier than 2026.3.28. The weakness exists in the webhook handler of the Nextcloud Talk integration, which is implemented in Node.js. No specific operating system or runtime version is singled out beyond the application level.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers only need network access to the exposed webhook endpoint to launch brute‑force attempts; no additional privilege escalation is required. Successful exploitation can lead to unauthorized command execution via forged events, data leakage, or service disruption, but it does not provide arbitrary code execution on the host.