PT-2026-23544 · Clawdbot+1 · Clawdbot+1

Vincent Koc · CVE-2026-28469 · Published 2026-02-18 · Updated 2026-03-10

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14 clawdbot versions prior to 2026.1.24-3

Description The software contains a webhook routing issue in the Google Chat monitor component. This allows for cross-account policy context misrouting when multiple webhook targets share the same HTTP path. Attackers can exploit first-match request verification semantics to process inbound webhook events under incorrect account contexts, bypassing intended allowlists and session policies. The affected component is extensions/googlechat/src/monitor.ts. The issue arises from allowing multiple webhook targets per path and selecting the first target that passes verifyGoogleChatRequest(...).

Recommendations OpenClaw versions prior to 2026.2.14: Upgrade to version 2026.2.14 or later. clawdbot versions prior to 2026.1.24-3: Migrate to OpenClaw and upgrade to OpenClaw version 2026.2.14 or later. Ensure each Google Chat webhook target uses a unique webhook path to avoid ambiguous routing.

Exploit

Fix

IDOR

Improper Access Control

Weakness Enumeration

CWE-639

CWE-284

Related Identifiers

CVE-2026-28469

GHSA-RQ6G-PX6M-C248

Affected Products

Openclaw

Clawdbot

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28469.json · Exploit
• https://github.com/openclaw/openclaw/security/advisories/GHSA-rq6g-px6m-c248 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/61d59a802869177d9cef52204767cd83357ab79e · Patch
• https://osv.dev/vulnerability/GHSA-rq6g-px6m-c248 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28469 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28469 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.14 · Note
• https://twitter.com/TheHackerWire/status/2029906886808719621 · Twitter Post
• https://vulncheck.com/advisories/openclaw-cross-account-policy-context-misrouting-via-shared-webhook-path-ambiguity · Note
• https://t.me/CVEtracker/46488 · Telegram Post
• https://twitter.com/dailycve/status/2031209327852142838 · Twitter Post
• https://twitter.com/CVEnew/status/2030385178342735951 · Twitter Post
• https://twitter.com/CveFindCom/status/2029689105718661506 · Twitter Post