CVE-2026-33580：OpenClaw速率限制缺失漏洞，版本低于2026.3.28

OpenClaw 中的 CVE-2026-33580 影响了 Nextcloud Talk 通过 Webhook 的集成。具体来说，系统缺乏对 Webhook 签名验证失败的适当速率限制。由于此集成依赖于操作员配置的共享密钥，而该密钥可能较弱，因此能够访问 Webhook 端点的攻击者可能会尝试对该密钥进行暴力破解攻击。一旦密钥被攻破，攻击者就可以伪造传入的 Webhook 事件，从而可能操纵 Nextcloud Talk 的行为。

Organizations using Nextcloud Talk with webhooks, particularly those relying on weak or default shared secrets for webhook authentication, are at risk. Shared hosting environments where multiple users share the same Nextcloud instance and webhook configurations are also potentially vulnerable.

• nodejs / server: Monitor Nextcloud Talk logs for repeated failed webhook authentication attempts. Look for patterns of requests originating from the same IP address with different signatures.

journalctl -u nextcloud-talk --grep 'webhook authentication failure'

• generic web: Check the Nextcloud Talk webhook endpoint for unusual activity using curl or wget. Verify that only expected requests are being received.

curl -v <webhook_url>

1. 2026-03-31Disclosure

   disclosure

1. 已保留2026-03-23
2. 发布日期2026-03-31
3. 修改日期2026-04-06
4. EPSS 更新日期2026-04-08

为了减轻此风险，建议将 OpenClaw 更新到 2026.3.28 或更高版本。此版本包含一项修复程序，可实现必要的速率限制，以防止对 Webhook 签名验证的暴力破解攻击。此外，建议为配置 Nextcloud Talk 集成使用强大且随机的密码或共享密钥。监控 Nextcloud Talk 日志中是否存在异常访问尝试或重复的签名验证失败也可以帮助检测和响应潜在的攻击。