PT-2026-34785 · Openclaw · Openclaw

Steven Siegfried · Published 2026-04-07 · Updated 2026-04-25 · CVE-2026-41354

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.2

Description An insufficient scope issue exists in Zalo webhook replay dedupe keys. This allows legitimate events from different senders or conversations to collide, enabling attackers to exploit weak deduplication scoping to cause silent message suppression and disrupt bot workflows across chat sessions.

Recommendations Update to version 2026.4.2.

Fix

Weakness Enumeration

CWE-440

CWE-706

CWE-349

Related Identifiers

CVE-2026-41354

GHSA-6477-WVJJ-47V6

GHSA-RXMX-G7HR-8MX4

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/security/advisories/GHSA-rxmx-g7hr-8mx4 · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/ef7c553dd16ee579f1d1a363f5881a99726c1412 · Patch
• https://osv.dev/vulnerability/GHSA-6477-wvjj-47v6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41354 · Security Note
• https://osv.dev/vulnerability/GHSA-rxmx-g7hr-8mx4 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2048168354574471202 · Twitter Post
• https://vulncheck.com/advisories/openclaw-insufficient-scope-in-zalo-webhook-replay-dedupe-keys · Note