Understanding the OpenClaw Webhook Replay Vulnerability
A significant security flaw, identified as CVE-2026-28449, has been discovered in OpenClaw for Node.js. This vulnerability could allow attackers to manipulate webhook events, potentially leading to data integrity and availability problems within systems using affected versions.
CVE Details
CVE ID: CVE-2026-28449
Product Name: OpenClaw (specifically for Node.js applications)
Published Date: March 19, 2026
Severity: Medium
Status: Analyzed
Affected Products
This vulnerability impacts versions of OpenClaw for Node.js that are older than 2026.2.25. If you are using any version of OpenClaw prior to 2026.2.25 in your Node.js environment, your system may be at risk.
Current Status
The vulnerability has been officially “Analyzed.” This means it has been investigated and documented, and a fix is available.
Severity Level
Rated as Medium severity, this flaw indicates a notable risk. The vulnerability allows an attacker to replay previously valid and signed Nextcloud Talk webhook requests. Without proper suppression of these replayed requests, systems could process duplicate inbound messages. This could lead to incorrect data, system malfunctions, or even denial-of-service conditions, impacting the integrity and availability of your applications.
Possible Solutions
The good news is that a fix for this vulnerability is available. Users of OpenClaw for Node.js are strongly advised to update their installations to version 2026.2.25 or newer. This update introduces durable replay state for Nextcloud Talk webhook events, ensuring that valid signed requests cannot be replayed without detection and suppression. Promptly applying this update is crucial to protect your systems from potential attacks.
References
https://github.com/openclaw/openclaw/commit/d512163d686ad6741783e7119ddb3437f493dbbc
https://github.com/openclaw/openclaw/security/advisories/GHSA-r9q5-c7qc-p26w
https://www.vulncheck.com/advisories/openclaw-webhook-replay-attack-via-missing-durable-replay-suppression
