CVE-2026-41395
Webhook Replay Vulnerability in OpenClaw Plivo V3 Causes Duplicate Calls
Publication date: 2026-04-28
Last updated on: 2026-04-30
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.3.28 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-325 | The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-41395 is a vulnerability in OpenClaw versions before 2026.3.28 related to the Plivo V3 webhook signature verification process.
The issue occurs because OpenClaw sorts (canonicalizes) query parameters when generating signatures but uses the raw, unsorted URL for replay detection hashing.
This mismatch allows attackers who have captured a valid signed webhook URL to reorder the query parameters and bypass the replay cache detection.
As a result, attackers can replay the same webhook multiple times, causing duplicate voice-call processing.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers to replay valid signed webhooks multiple times, causing duplicate voice-call processing. This unauthorized duplication impacts the integrity of the system by allowing repeated processing of events that should be unique.
While the CVE description and resources do not explicitly mention compliance with standards such as GDPR or HIPAA, the integrity impact could potentially affect compliance where accurate and reliable processing of events is required to protect personal data or ensure auditability.
However, there is no direct information provided about specific effects on compliance with GDPR, HIPAA, or other regulations.
How can this vulnerability impact me? :
This vulnerability allows attackers to replay valid signed webhooks multiple times without detection.
The impact is unauthorized duplication of voice-call events, which can lead to repeated or fraudulent processing of voice calls.
Since no privileges or user interaction are required to exploit this vulnerability, it poses a significant risk to systems using affected OpenClaw versions with Plivo V3 webhooks.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves replay attacks by reordering query parameters in Plivo V3 webhook URLs. Detection involves monitoring for repeated webhook requests with the same signature but different query parameter orders.
You can detect potential exploitation by capturing and analyzing incoming webhook requests to identify duplicates that differ only in the order of query parameters.
Suggested commands include using network traffic capture tools like tcpdump or Wireshark to log webhook requests, then using command-line tools such as grep, awk, or jq to filter and compare URLs for replays with reordered query parameters.
- Capture network traffic on the webhook endpoint port (e.g., tcpdump -i eth0 port 80 or 443 -w webhook.pcap)
- Extract HTTP requests from the capture (e.g., tshark -r webhook.pcap -Y 'http.request' -T fields -e http.request.full_uri)
- Identify repeated webhook URLs with the same signature but different query parameter orders by sorting query parameters and comparing hashes.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to upgrade OpenClaw to version 2026.3.28 or later, where the vulnerability is fixed by canonicalizing the query parameters during replay detection.
Until the upgrade can be applied, consider implementing additional webhook replay detection mechanisms that normalize query parameter order before checking for duplicates.
Also, monitor webhook traffic for suspicious repeated requests and apply rate limiting or other controls to reduce the impact of replayed webhooks.