N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-r9q5-c7qc-p26w

GHSA-r9q5-c7qc-p26w: OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing

Summary

When Nextcloud Talk webhook signing was valid, replayed requests could be accepted without durable replay suppression, allowing duplicate inbound processing after replay-window expiry or process restart.

Details

OpenClaw's Nextcloud Talk webhook path verified HMAC(secret, random + body) but previously lacked durable replay state tied to webhook events. This allowed replay of a previously valid signed request in some operational conditions.

The fix on main adds:

persistent per-account replay dedupe for Nextcloud Talk webhook events,
replay checks before webhook side effects (onMessage),
backend-origin validation against configured account base URL (when configured).

Impact

A captured valid signed webhook request could be replayed to trigger duplicate inbound handling. This is an integrity/availability issue (duplicate actions/noise), scoped to deployments using Nextcloud Talk webhook integration.

Affected Packages / Versions

Package: openclaw (npm)
Affected: <= 2026.2.24
Patched in release: 2026.2.25

Fix Commit(s)

d512163d686ad6741783e7119ddb3437f493dbbc

Release Process Note

patched_versions is pre-set to the release (2026.2.25) so once npm release 2026.2.25 is published, advisory is now published.

OpenClaw thanks @aristorechina for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-r9q5-c7qc-p26w

GHSA-r9q5-c7qc-p26w:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.2.24	2026.2.25

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability is a replay attack weakness in the Nextcloud Talk webhook integration. The provided patch d512163d686ad6741783e7119ddb3437f493dbbc addresses this by adding a durable replay suppression mechanism. The analysis of the patch points to extensions/nextcloud-talk/src/monitor.ts as the location of the vulnerable code. Specifically, the createNextcloudTalkWebhookServer function sets up an HTTP server whose request handler processes incoming webhooks. Before the fix, this handler would verify the request's signature and then call the onMessage function to process the event. The vulnerability was the absence of a check to determine if the webhook's message had been processed before. An attacker could capture a valid request and replay it to trigger duplicate actions. The fix introduces a shouldProcessMessage function into the request handling logic, which is responsible for checking against a persistent log of processed message IDs to prevent duplicates. The vulnerable function is identified as createNextcloudTalkWebhookServer because it is the named function responsible for creating the insecure request handler.

Vulnerable functions

createNextcloudTalkWebhookServer

extensions/nextcloud-talk/src/monitor.ts

The vulnerability existed in the anonymous request handler created within the `createNextcloudTalkWebhookServer` function. This handler was responsible for processing incoming Nextcloud Talk webhooks. Prior to the patch, after validating the webhook's signature, the server would immediately proceed to call the `onMessage` handler. It lacked a mechanism to detect and discard replayed requests. This allowed a previously captured valid webhook to be sent again, causing duplicate processing of the same event. The patch rectifies this by introducing a `shouldProcessMessage` check, which consults a persistent replay guard before invoking the `onMessage` handler.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-r9q5-c7qc-p26w: OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing

Summary

Details

Impact

Affected Packages / Versions

Fix Commit(s)

Release Process Note

GHSA-r9q5-c7qc-p26w:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

GHSA-r9q5-c7qc-p26w: OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing

Summary

Details

Impact

Affected Packages / Versions

Fix Commit(s)

Release Process Note

N/A

N/A

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI