CVE-2026-41402
Scope Bypass in OpenClaw Webhook Cache Enables Replay Attacks
Publication date: 2026-04-28
Last updated on: 2026-04-30
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openclaw | openclaw | to 2026.3.31 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-706 | The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in OpenClaw versions before 2026.3.31 and involves a scope bypass in the webhook replay cache deduplication mechanism.
Authenticated attackers can exploit this flaw by replaying messages across sibling targets that share the same messageId.
The root cause is overly broad cache keying, which allows attackers to bypass replay protection and deliver duplicate webhook messages to unintended targets.
How can this vulnerability impact me? :
The vulnerability allows attackers to bypass replay protection and send duplicate webhook messages to unintended targets.
This could lead to confusion or unintended processing of repeated webhook events by sibling targets, potentially causing inconsistent system behavior or unauthorized actions triggered by replayed messages.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-41402 vulnerability, you should upgrade OpenClaw to version 2026.3.31 or later, as this version contains the fix for the scope bypass issue in the webhook replay cache deduplication mechanism.
This update addresses the overly broad cache keying that allowed authenticated attackers to replay webhook messages across sibling targets, thereby restoring proper replay protection.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.