EUVD-2026-25338
GHSA-6477-wvjj-47v6
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Webhook endpoint is network-reachable without authentication (AV:N/PR:N), but exploiting requires message_id collision across sessions (AC:H); impact is suppression only, no C/I compromise (A:L/C:N/I:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7Blast Radius
ecosystem impact- 5 npm packages depend on openclaw (5 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.4.2.
DescriptionCVE.org
OpenClaw before 2026.4.2 contains an insufficient scope vulnerability in Zalo webhook replay dedupe keys that allows legitimate events from different conversations or senders to collide. Attackers can exploit weak deduplication scoping to cause silent message suppression and disrupt bot workflows across chat sessions.
AnalysisAI
Silent message suppression in OpenClaw's Zalo webhook integration allows deduplicate key collisions across distinct conversations and senders, causing legitimate bot events to be silently dropped. All OpenClaw npm installations prior to version 2026.4.2 are affected via CPE cpe:2.3:a:openclaw:openclaw. An unauthenticated network attacker who can send or replay Zalo webhook events with a predictable message_id can cause cross-chat or cross-sender deduplication collisions, disrupting bot workflows without any visible error. No public exploit has been identified at time of analysis; EPSS is 0.04% (11th percentile) and SSVC confirms no active exploitation.
Technical ContextAI
CWE-706 (Use of Incorrectly-Resolved Name or Reference) describes the root cause: the deduplication key in the Zalo webhook handler (extensions/zalo/src/monitor.webhook.ts) was constructed as ${target.path}:${account.accountId}:${event_name}:${messageId}, omitting the chatId and senderId dimensions. Because Zalo message IDs can be reused across different conversations or sender contexts, events from distinct origins could hash to the same key and be discarded as replays. The fix commit ef7c553dd16ee579f1d1a363f5881a99726c1412 extends the key to include update.message.chat.id and update.message.from.id, fully scoping deduplication to the correct event origin. The affected package is the npm module openclaw (CPE cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*) for versions up to and including 2026.4.1.
RemediationAI
Upgrade the OpenClaw npm package to version 2026.4.2 or later, which scopes the Zalo webhook replay dedupe key by chatId, senderId, event_name, and messageId to prevent cross-conversation and cross-sender collisions. The fix is available in commit ef7c553dd16ee579f1d1a363f5881a99726c1412 at https://github.com/openclaw/openclaw/commit/ef7c553dd16ee579f1d1a363f5881a99726c1412, and the vendor advisory is at https://github.com/openclaw/openclaw/security/advisories/GHSA-rxmx-g7hr-8mx4. The advisory notes that 2026.4.2 was staged for npm publish at advisory time; confirm the release is live on npm before deploying. If immediate upgrade is not feasible, a compensating control is to disable or bypass Zalo webhook replay deduplication in your integration layer, though this trade-off reintroduces the risk of duplicate event processing that deduplication was designed to prevent. Restricting which IP sources may deliver webhook events reduces the attacker's ability to inject colliding events but does not eliminate the scoping flaw.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today