VULNERABILITY INTELLIGENCE

CVE-2026-41337

CVSS score6.3 MEDIUM
EPSS probability0.23%
CISA KEVNot currently listed
Published2026-04-23
Last modified2026-06-17
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Description

OpenClaw before 2026.3.31 contains a callback origin mutation vulnerability in Plivo voice-call replay that allows attackers to mutate in-process callback origin before replay rejection. Attackers with captured valid callbacks for live calls can exploit this to manipulate callback origins during the replay process.

Weakness classification

  • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

Primary references