Skip to content
Log inStart free trial

GHSA-cg6c-q2hx-69h7 CVE-2026-35618

OpenClaw: Plivo V2 verified replay identity drifts on query-only variants

Medium npm
Severity
0.0 / 10
Medium · CVSS 4.0
Exploit chance (EPSS)
0.28%
Chance of exploitation in the next 30 days. Higher than 20.88% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-294 Authentication Bypass by Capture-replay
Fix
2026.3.23
Upgrade openclaw to this version or later

Description

Summary

Before v2026.3.23, the Plivo V2 verification path treated query-only variants of the same signed request as fresh verified work. Plivo V2 signatures authenticate baseUrl + nonce, but the replay key was derived from the full verification URL including the query string, so unsigned query-only changes minted a new verifiedRequestKey.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected: < 2026.3.23
  • Fixed: >= 2026.3.23
  • Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87)
  • Latest published npm version checked: 2026.3.23-2

Root Cause

The vulnerable logic lived in extensions/voice-call/src/webhook-security.ts. V2 signature validation already canonicalized to the base URL without query parameters, but the replay key used the full verificationUrl, letting query-only variants bypass replay identity stability.

Fix Commit(s)

  • b0ce53a79cf63834660270513e26d921899b4e5b — fix(voice-call): stabilize plivo v2 replay keys

Release Status

The fix commit is contained in released tags v2026.3.23 and v2026.3.23-2. The latest shipped tag and npm release both include the fix.

Code-Level Confirmation

  • extensions/voice-call/src/webhook-security.ts now derives the V2 replay key with createPlivoV2ReplayKey(...), which hashes getBaseUrlNoQuery(url) plus the nonce.
  • extensions/voice-call/src/webhook-security.test.ts contains the regression test treats query-only V2 variants as the same verified request.

Thanks @smaeljaish771 for reporting.

Affected versions

npm

PackageVulnerableFixed in
openclaw
< 2026.3.23
2026.3.23

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

openclaw npm → 2026.3.23

npm
npm install openclaw@2026.3.23
yarn
yarn add openclaw@2026.3.23
pnpm
pnpm add openclaw@2026.3.23

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Attack vector
Network
Attack complexity
Low
Attack requirements
Present
Privileges required
None
User interaction
None
Confidentiality (vulnerable system)
None
Integrity (vulnerable system)
High
Availability (vulnerable system)
None
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None

CVSS 3.1 6.5

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
None

Weakness

CWE-294: Authentication Bypass by Capture-replay

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

How to prevent it
  • Architecture and Design: Utilize some sequence or time stamping functionality along with a checksum which takes this into account in order to ensure that messages can be parsed only once.
  • Architecture and Design: Since any attacker who can listen to traffic can see sequence numbers, it is necessary to sign messages with some kind of cryptography to ensure that sequence numbers are not simply doctored along with content.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-3x84-qq85-fj65
OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs
High Also affects openclaw
GHSA-9c3v-684m-579c
OpenClaw MCP SSE redirects could forward Authorization headers
Medium Also affects openclaw
GHSA-f397-5vjw-v2c2
OpenClaw: Shell inline-command parsing could miss an allowlist check
High Also affects openclaw
GHSA-rx78-29qr-5hq8
OpenClaw: Workspace-derived service PATH could influence trash command selection
High Also affects openclaw
GHSA-ccwh-wwpp-6wg5
OpenClaw: Host environment sanitizer missed two Node.js control variables
High Also affects openclaw
GHSA-985f-72mj-8gf7
OpenClaw: Tool group policy callers could accept unvalidated group IDs
Medium Also affects openclaw
GHSA-9v8j-9c9g-w66c
OpenClaw: Bootstrap token replay could widen pending pairing scopes
Medium Also affects openclaw
GHSA-c226-q6fx-6j6c
OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags
Medium Also affects openclaw
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor