PT-2026-35779 · Openclaw · Openclaw

Keensecuritylab · Published 2026-03-31 · Updated 2026-04-30 · CVE-2026-41395

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.28

Description An issue exists in Plivo V3 signature verification where the system canonicalizes query ordering for signatures but hashes raw URLs for replay detection. This allows attackers to reorder query parameters to bypass replay cache detection, enabling the triggering of duplicate voice-call processing using a captured valid signed webhook.

Recommendations Update to version 2026.3.28.

Fix

Weakness Enumeration

CWE-325

CWE-294

Related Identifiers

CVE-2026-41395

GHSA-8689-GM9G-JGR6

Affected Products

Openclaw

References · 8

• https://github.com/openclaw/openclaw/security/advisories/GHSA-8689-gm9g-jgr6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41395 · Security Note
• https://osv.dev/vulnerability/GHSA-8689-gm9g-jgr6 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/commit/85777e726cb02c01a911b3ff832ddf4d664d5c94 · Note
• https://vulncheck.com/advisories/openclaw-webhook-replay-via-query-parameter-reordering-in-plivo-v3 · Note
• https://twitter.com/CVEnew/status/2049227525256061370 · Twitter Post
• https://t.me/cveNotify/161653 · Telegram Post