Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-28465: OpenClaw voice-call can accept forged webhook events
CVE-2026-28465 · published 8 months ago
Summary
Versions of the OpenClaw voice‑call plugin released before 2026.2.3 may trust certain network headers and allow fake webhook notifications to be accepted. This could let an attacker make the system think a call or message was received when it was not. Update the plugin to version 2026.2.3 or later to restore proper verification.
What to do
- Update openclaw voice-call to version 2026.2.3.
- Update openclaw @openclaw/voice-call to version 2026.2.3.
- Update openclaw openclaw to version 2026.2.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | openclaw | voice-call |
< 2026.2.3 Fix: upgrade to 2026.2.3
|
| npm | clawdbot | voice-call | <= 2026.1.24 |
| – | openclaw | openclaw |
< 2026.2.3 cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:* |
| npm | openclaw | @openclaw/voice-call |
< 2026.2.3 Fix: upgrade to 2026.2.3
|
| npm | clawdbot | @clawdbot/voice-call | <= 2026.1.24 |
Original advisory text
OpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded Headers
OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by manipulating Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers.
References
- https://github.com/openclaw/openclaw/releases/tag/v2026.2.3
- https://github.com/advisories/GHSA-3m3q-x3gj-f79x
- https://github.com/openclaw/openclaw Product
- https://github.com/openclaw/openclaw/security/advisories/GHSA-3m3q-x3gj-f79x Vendor Advisory
- https://www.vulncheck.com/advisories/openclaw-voice-call-webhook-verification-by... Vendor Advisory
- https://github.com/openclaw/openclaw/commit/a749db9820eb6d6224032a5a34223d286d2d... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28465... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-28465 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.8
High
Type
CWE-345Insufficient Verification of Data Authenticity
CWE-287Improper Authentication
CWE-290Authentication Bypass by Spoofing
Timeline
Published5 Mar 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2026-28465 · NVD
GHSA-3m3q-x3gj-f79x · GHSA
GHSA-3m3q-x3gj-f79x · OSV
CVE-2026-28465 · MITRE
CVE-2026-28465 · OSV
Track software like this
Free during beta