Vulnerability in Openclaw
CVE-2026-28465
OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by manipulating Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.007 (50.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 50th percentile — 50.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.007 · change: +0.003
Affected products
- Openclaw
- Openclaw Voice-Call — versions 0
Weakness classification (CWE)
References
- github.com/openclaw/openclaw/security/advisories/GHSA-3m3q-x3gj-f79x (vendor-advisory, Vendor Advisory)
- github.com/openclaw/openclaw/commit/a749db9820eb6d6224032a5a34223d286d2dcc2f (Patch, patch)
- www.vulncheck.com/advisories/openclaw-voice-call-webhook-verification-bypass-vi… (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-28465?
- CVE-2026-28465 is a medium-severity vulnerability in Openclaw, classified under Authentication Bypass by Spoofing. CVSS score: 5.9/10. Published 2026-03-05.
- How severe is CVE-2026-28465?
- Medium severity. CVSS v3 base score is 5.9 out of 10.