GHSA-gcj7-r3hg-m7w6

OpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity

Low npm

Severity: 3.7 / 10; Low · CVSS 3.1
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: CWE-294 Authentication Bypass by Capture-replay; CWE-345 Insufficient Verification of Data Authenticity
Fix: 2026.2.26; Upgrade openclaw to this version or later

Description

Summary

The voice-call Twilio webhook path accepted replay/dedupe identity from unsigned request metadata (i-twilio-idempotency-token), enabling replayed signed requests to bypass replay detection and manager dedupe by mutating only that header.

Affected Packages / Versions

Package: openclaw (npm)
Affected versions: <= 2026.2.25 (latest published npm version at triage time)
Fixed on main: commit 1aadf26f9acc399affabd859937a09468a9c5cb4
Planned patched npm version: 2026.2.26

Impact

Deployments using the optional voice-call Twilio webhook path could accept replayed webhook events as fresh events when an attacker had one valid signed request and changed only the unsigned idempotency header.

Technical Details

The fix removes unsigned-header trust from Twilio replay/dedupe identity and binds replay/manager dedupe to authenticated request material. It also threads a verified request identity through provider parsing so dedupe uses verification-derived identity rather than mutable headers.

Fix Commit(s)

1aadf26f9acc399affabd859937a09468a9c5cb4

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.26). After the npm release is published, this advisory can be published without additional version-field edits.

OpenClaw thanks @tdjackey for reporting.

Affected versions

npm

Package	Vulnerable	Fixed in
openclaw	`< 2026.2.26`	`2026.2.26`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

openclaw npm → `2026.2.26`

npm

npm install openclaw@2026.2.26

yarn

yarn add openclaw@2026.2.26

pnpm

pnpm add openclaw@2026.2.26

Severity breakdown

CVSS 3.1 3.7

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: Low

Weakness

CWE-294: Authentication Bypass by Capture-replay

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

How to prevent it

Architecture and Design: Utilize some sequence or time stamping functionality along with a checksum which takes this into account in order to ensure that messages can be parsed only once.
Architecture and Design: Since any attacker who can listen to traffic can see sequence numbers, it is necessary to sign messages with some kind of cryptography to ensure that sequence numbers are not simply doctored along with content.

CWE-345: Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References

Packages

github.com/openclaw/openclaw

Timeline

Mar 3, 2026 Published
Mar 4, 2026 Last updated by the source

Advisory	Severity	Why it's related
GHSA-3x84-qq85-fj65 OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs	High	Also affects openclaw
GHSA-9c3v-684m-579c OpenClaw MCP SSE redirects could forward Authorization headers	Medium	Also affects openclaw
GHSA-f397-5vjw-v2c2 OpenClaw: Shell inline-command parsing could miss an allowlist check	High	Also affects openclaw
GHSA-rx78-29qr-5hq8 OpenClaw: Workspace-derived service PATH could influence trash command selection	High	Also affects openclaw
GHSA-ccwh-wwpp-6wg5 OpenClaw: Host environment sanitizer missed two Node.js control variables	High	Also affects openclaw
GHSA-985f-72mj-8gf7 OpenClaw: Tool group policy callers could accept unvalidated group IDs	Medium	Also affects openclaw
GHSA-9v8j-9c9g-w66c OpenClaw: Bootstrap token replay could widen pending pairing scopes	Medium	Also affects openclaw
GHSA-c226-q6fx-6j6c OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags	Medium	Also affects openclaw

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor