VULNERABILITY INTELLIGENCE

CVE-2026-28465

CVSS score5.9 MEDIUM

EPSS probability0.43%

CISA KEVNot currently listed

Published2026-03-05

Last modified2026-09-17

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by manipulating Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers.

Weakness classification

disclosure@vulncheck.com: CWE-290
nvd@nist.gov: CWE-290

Primary references

disclosure@vulncheck.com — Patch
disclosure@vulncheck.com — Vendor Advisory
disclosure@vulncheck.com — Third Party Advisory