CVE-2026-41354CWE-706

OpenClaw < 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe Keys

Medium · published April 23, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
41.1
In the wild
Unconfirmed
What it is

OpenClaw before 2026.4.2 contains an insufficient scope vulnerability in Zalo webhook replay dedupe keys that allows legitimate events from different conversations or senders to collide. Attackers can exploit weak deduplication scoping to cause silent message suppression and disrupt bot workflows across chat sessions.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00488 · 41.1th percentile
Weakness
CWE-706 · Use of Incorrectly-Resolved Name or Reference
Published
2026-04-23T21:58Z
EPSS history
Timeline
  • 23 APR 21:58Z
    OpenClaw < 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe Keys
    cvelistv5