EUVD-2026-21103
GHSA-j56c-wpqm-h24x
CVSS VectorNVD
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6Blast Radius
ecosystem impact- 2 npm packages depend on openclaw (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.23.
DescriptionNVD
OpenClaw before 2026.3.23 contains a replay identity vulnerability in Plivo V2 signature verification that allows attackers to bypass replay protection by modifying query parameters. The verification path derives replay keys from the full URL including query strings instead of the canonicalized base URL, enabling attackers to mint new verified request keys through unsigned query-only changes to signed requests.
AnalysisAI
OpenClaw's Plivo V2 signature verification implementation allows remote attackers to bypass replay protection and forge authenticated requests by manipulating URL query parameters. The flaw affects OpenClaw versions before 2026.3.23 and stems from deriving replay protection keys from the full URL including query strings rather than the canonical base URL, enabling attackers to create new valid request signatures by modifying only query parameters on previously signed requests. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all OpenClaw deployments and confirm versions in use; disable or restrict Plivo V2 API integrations if version 2026.3.23 or later cannot be deployed immediately. Within 7 days: Apply vendor patch to upgrade all OpenClaw instances to version 2026.3.23 or later. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today