PT-2026-34768 · Plivo · Openclaw

Keensecuritylab · Published 2026-04-02 · Updated 2026-04-25 · CVE-2026-41337

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.31

Description A callback origin mutation issue exists in Plivo voice-call replay. This allows attackers who have captured valid callbacks for live calls to mutate the in-process callback origin before the replay is rejected, enabling the manipulation of callback origins during the replay process.

Recommendations Update to version 2026.3.31.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

CWE-294

Related Identifiers

CVE-2026-41337

GHSA-89R3-6X4J-V7WF

GHSA-CW28-63X4-37C3

Affected Products

Openclaw

References · 9

• https://github.com/openclaw/openclaw/commit/efe9183f9d2fd5e01c8068fa01f4a07a58a63c0b · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-89r3-6x4j-v7wf · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-89r3-6x4j-v7wf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41337 · Security Note
• https://osv.dev/vulnerability/GHSA-cw28-63x4-37c3 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/releases/tag/v2026.3.31 · Note
• https://twitter.com/CVEnew/status/2048168371007766630 · Twitter Post
• https://vulncheck.com/advisories/openclaw-callback-origin-mutation-in-plivo-voice-call-replay · Note