Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-41395: OpenClaw Plivo Webhook Replay Vulnerability

CVE-2026-41395 · published 6 months ago

Summary

If you're using OpenClaw and Plivo V3, an attacker could trick your system into processing the same voice call multiple times by manipulating the order of query parameters in a signed webhook. This could lead to unexpected charges or other issues. To protect yourself, update OpenClaw to version 2026.3.28 or later.

Original advisory text

OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes query ordering for signatures but hashes raw URLs for replay detection. Attackers can reorder query parameters to bypass replay cache detection and trigger duplicate voice-call processing with a captured valid signed webhook.

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.2 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-325Missing Cryptographic Step

Timeline

Published28 Apr 2026

Updated26 Oct 2026

First seen28 Apr 2026

Sources

CVE-2026-41395 · NVD

Track software like this

Free during beta