CVE-2026-33580

MediumCVSS 6.5/10Last modified Jul 24, 2026

Description

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting authentication without throttling.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-307

Affected software

No affected versions have been published.

Timeline

Published: Mar 31, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-335818.6OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by CVE-2026-335826.5Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. A crafted CVE-2026-335838.7Exposure of the QKEY (used as input into the ‘OTA-Quantum’ device registration process) and internal system keys via an unauthenticated an CVE-2026-335845.3Exposed Keycloak management service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug informati CVE-2026-335853.8Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacker to impersonate an CVE-2026-335866.3Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail ser CVE-2026-3358710.0Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on CVE-2026-335888.1Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to create or modify files CVE-2026-335896.5Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to access local files con CVE-2026-33597.5The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inpu CVE-2026-335908.5Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code e CVE-2026-3359110.0A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass security restriction using a s