Executive Summary

CVE-2026-41395 is a vulnerability in OpenClaw versions before 2026.3.28 related to the Plivo V3 webhook signature verification process.

The issue occurs because OpenClaw sorts (canonicalizes) query parameters when generating signatures but uses the raw, unsorted URL for replay detection hashing.

This mismatch allows attackers who have captured a valid signed webhook URL to reorder the query parameters and bypass the replay cache detection.

As a result, attackers can replay the same webhook multiple times, causing duplicate voice-call processing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to replay valid signed webhooks multiple times without detection.

The impact is unauthorized duplication of voice-call events, which can lead to repeated or fraudulent processing of voice calls.

Since no privileges or user interaction are required to exploit this vulnerability, it poses a significant risk to systems using affected OpenClaw versions with Plivo V3 webhooks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves replay attacks by reordering query parameters in Plivo V3 webhook URLs. Detection involves monitoring for repeated webhook requests with the same signature but different query parameter orders.

You can detect potential exploitation by capturing and analyzing incoming webhook requests to identify duplicates that differ only in the order of query parameters.

Suggested commands include using network traffic capture tools like tcpdump or Wireshark to log webhook requests, then using command-line tools such as grep, awk, or jq to filter and compare URLs for replays with reordered query parameters.

• Capture network traffic on the webhook endpoint port (e.g., tcpdump -i eth0 port 80 or 443 -w webhook.pcap)
• Extract HTTP requests from the capture (e.g., tshark -r webhook.pcap -Y 'http.request' -T fields -e http.request.full_uri)
• Identify repeated webhook URLs with the same signature but different query parameter orders by sorting query parameters and comparing hashes.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade OpenClaw to version 2026.3.28 or later, where the vulnerability is fixed by canonicalizing the query parameters during replay detection.

Until the upgrade can be applied, consider implementing additional webhook replay detection mechanisms that normalize query parameter order before checking for duplicates.

Also, monitor webhook traffic for suspicious repeated requests and apply rate limiting or other controls to reduce the impact of replayed webhooks.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows attackers to replay valid signed webhooks multiple times, causing duplicate voice-call processing. This unauthorized duplication impacts the integrity of the system by allowing repeated processing of events that should be unique.

While the CVE description and resources do not explicitly mention compliance with standards such as GDPR or HIPAA, the integrity impact could potentially affect compliance where accurate and reliable processing of events is required to protect personal data or ensure auditability.

However, there is no direct information provided about specific effects on compliance with GDPR, HIPAA, or other regulations.

Useful 0 Not Useful 0