PT-2026-26735 · Openclaw · Openclaw

Jisung · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-32053

Mitre

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are randomized per parse, allowing replay events to bypass manager dedupe checks. Attackers can replay Twilio webhook events to trigger duplicate or stale call-state transitions, potentially causing incorrect call handling and state corruption.

Fix

Weakness Enumeration

CWE-294

Related Identifiers

CVE-2026-32053

Affected Products

Openclaw

References · 4

• https://github.com/openclaw/openclaw/commit/1d28da55a5d0ff409e34999e0961157e9db0a2ab · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32053 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-vqx8-9xxw-f2m7 · Note
• https://vulncheck.com/advisories/openclaw-twilio-webhook-replay-bypass-via-randomized-event-id-normalization · Note