CVE-2026-28465
OpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded Headers
- State
- Published
- Severity
- 8.2 High
- Published
- Mar 5, 2026
- Updated
- Oct 1, 2026
- Reserved
- Feb 27, 2026
Description
OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by manipulating Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.2 High | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.9 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N | VulnCheck |
Weaknesses
- CWE-290 Authentication bypass by spoofing
Affected Products
| Product | Versions |
|---|---|
voice-callOpenClaw |
|
References
- GitHub Security Advisory (GHSA-3m3q-x3gj-f79x)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: OpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded Headersthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.