CVE-2026-41362

MEDIUM

OpenClaw 2026.2.19 < 2026.3.31 - Webhook Replay Dedupe Cache Event Suppression via Shared Authentication

Title source: cna
STIX 2.1

Description

OpenClaw versions 2026.2.19 before 2026.3.31 contain an improper cache isolation vulnerability in the Zalo webhook replay-dedupe mechanism that is shared across authenticated webhook targets. Attackers controlling one authenticated Zalo webhook path in multi-account deployments can suppress legitimate events on different accounts by matching event_name and message_id parameters.

References (4)

Core 4
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-fqrj-m88p-qf3v)
https://github.com/openclaw/openclaw/security/advisories/GHSA-fqrj-m88p-qf3v
Third Party Advisory third-party-advisory
VulnCheck Advisory: OpenClaw 2026.2.19 < 2026.3.31 - Webhook Replay Dedupe Cache Event Suppression via Shared Authentication
https://www.vulncheck.com/advisories/openclaw-webhook-replay-dedupe-cache-event-suppression-via-shared-authentication

Scores

CVSS v3 4.3
EPSS 0.0027
EPSS Percentile 18.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-668
Status published
Products (3)
OpenClaw/OpenClaw 2026.2.19 - 2026.3.31
openclaw/openclaw 2026.2.19 - 2026.3.31
OpenClaw/OpenClaw 2026.3.31
Published Apr 28, 2026
Tracked Since Apr 28, 2026