CVE-2026-41354: OpenClaw < 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe Keys

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-23 · updated 2026-06-17
Weakness: CWE-706

Description

OpenClaw before 2026.4.2 contains an insufficient scope vulnerability in Zalo webhook replay dedupe keys that allows legitimate events from different conversations or senders to collide. Attackers can exploit weak deduplication scoping to cause silent message suppression and disrupt bot workflows across chat sessions.

Affected products

OpenClaw: before 2026.4.2 — fixed in 2026.4.2

How to fix

Upgrade to a fixed version: OpenClaw 2026.4.2. Check the vendor advisory for mitigations.

References

https://github.com/openclaw/openclaw/commit/ef7c553dd16ee579f1d1a363f5881a99726c1412
https://github.com/openclaw/openclaw/security/advisories/GHSA-rxmx-g7hr-8mx4
https://www.vulncheck.com/advisories/openclaw-insufficient-scope-in-zalo-webhook-replay-dedupe-keys

Get alerted when CVE-2026-41354 or the next vulnerability affects your stack