EUVD-2026-25321
GHSA-cw28-63x4-37c3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AT:P in the 4.0 vector maps to AC:H in 3.1, reflecting the prerequisite of a captured live-call callback; only low confidentiality impact from redirected callback metadata.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6Blast Radius
ecosystem impact- 1 npm packages depend on openclaw (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.31.
DescriptionCVE.org
OpenClaw before 2026.3.31 contains a callback origin mutation vulnerability in Plivo voice-call replay that allows attackers to mutate in-process callback origin before replay rejection. Attackers with captured valid callbacks for live calls can exploit this to manipulate callback origins during the replay process.
AnalysisAI
Callback origin mutation in OpenClaw's Plivo voice-call replay handler allows an attacker in possession of a captured valid Plivo webhook callback for a live call to inject a modified Host header during the replay window, causing OpenClaw to store an attacker-controlled domain as the callback base URL before replay rejection occurs. All npm releases of openclaw up to and including 2026.3.28 are affected; the vendor-triaged severity is low and scope is narrow, requiring pre-capture of a live call's callback as an explicit prerequisite. No public exploit identified at time of analysis, and EPSS sits at 0.03% (7th percentile), consistent with minimal observed exploitation activity.
Technical ContextAI
OpenClaw is an npm package providing AI agent orchestration with voice-call capabilities, including native integration with the Plivo telephony provider via webhooks. The root cause is CWE-367 (Time-of-check Time-of-use): the PlivoProvider class previously derived the stored callback base URL from the incoming request's Host header or URL rather than pinning it to the operator-configured publicUrl option. During the interval between when a Plivo webhook event is parsed and when replay rejection fires, an attacker who can submit a replayed callback with a tampered Host header can corrupt the internal callUuidToWebhookUrl mapping for that call. The fix (commit efe9183f9d2fd5e01c8068fa01f4a07a58a63c0b) adds logic that, when publicUrl is configured, constructs the stored callback base using new URL(this.options.publicUrl) and preserves only the pathname from the incoming request, entirely ignoring the request's Host. CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:* scoped to versions 0 through 2026.3.28.
RemediationAI
Upgrade the openclaw npm package to version 2026.3.31 or later; this is the vendor-released patched version confirmed in the GitHub Security Advisory GHSA-89r3-6x4j-v7wf (https://github.com/openclaw/openclaw/security/advisories/GHSA-89r3-6x4j-v7wf) and implemented in commit efe9183f9d2fd5e01c8068fa01f4a07a58a63c0b. If immediate upgrade is not feasible, a compensating control is to enforce strict Host header validation at the reverse proxy or API gateway layer - only permitting requests whose Host matches the configured publicUrl hostname - which prevents an attacker from injecting a tampered Host into the webhook endpoint; note this does not eliminate the underlying TOCTOU race but removes the attacker's ability to control the origin value. Additionally, restricting inbound access to the Plivo webhook endpoint to Plivo's published source IP ranges reduces the population of attackers able to submit replayed callbacks at all.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today