What’s Vulnerable › Vulnerabilities

CVE-2026-28465: OpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded Headers

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-05 · updated 2026-09-17
• Weakness: CWE-290

Description

OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by manipulating Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers.

Affected products

• OpenClaw: before 2026.2.3 — fixed in 2026.2.3

How to fix

Upgrade to a fixed version: OpenClaw 2026.2.3. Check the vendor advisory for mitigations.

References

• https://github.com/openclaw/openclaw/commit/a749db9820eb6d6224032a5a34223d286d2dcc2f
• https://github.com/openclaw/openclaw/security/advisories/GHSA-3m3q-x3gj-f79x
• https://www.vulncheck.com/advisories/openclaw-voice-call-webhook-verification-bypass-via-forwarded-headers

Get alerted when CVE-2026-28465 or the next vulnerability affects your stack