PT-2026-26735 · Openclaw · Openclaw

Jisung · Published 2026-03-03 · Updated 2026-03-21 · CVE-2026-32053

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.23

Description OpenClaw contains a flaw in Twilio webhook event deduplication. Normalized event IDs are randomized during parsing, which allows replay events to bypass deduplication checks. This can lead to attackers replaying Twilio webhook events, triggering duplicate or stale call-state transitions, and potentially causing incorrect call handling and state corruption.

Recommendations Update OpenClaw to version 2026.2.23 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-294

Related Identifiers

CVE-2026-32053

GHSA-3R78-RQG8-95GG

GHSA-VQX8-9XXW-F2M7

Affected Products

Openclaw

References · 11

• https://github.com/openclaw/openclaw/commit/1d28da55a5d0ff409e34999e0961157e9db0a2ab · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-vqx8-9xxw-f2m7 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3r78-rqg8-95gg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vqx8-9xxw-f2m7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32053 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32053 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://vulncheck.com/advisories/openclaw-twilio-webhook-replay-bypass-via-randomized-event-id-normalization · Note
• https://twitter.com/CVEnew/status/2035237335353421986 · Twitter Post
• https://twitter.com/infoflowcloud/status/2035239192213557620 · Twitter Post
• https://twitter.com/tryclawhost/status/2035249674836189463 · Twitter Post