CVE-2026-41362CWE-668

OpenClaw 2026.2.19 through 2026.3.30 - Webhook Replay Dedupe Cache Event Suppression via Shared Authentication

Low · published April 27, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
40.6
In the wild
Unconfirmed
What it is

OpenClaw versions 2026.2.19 before 2026.3.31 contain an improper cache isolation vulnerability in the Zalo webhook replay-dedupe mechanism that is shared across authenticated webhook targets. Attackers controlling one authenticated Zalo webhook path in multi-account deployments can suppress legitimate events on different accounts by matching event_name and message_id parameters.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00482 · 40.6th percentile
Weakness
CWE-668 · Exposure of Resource to Wrong Sphere
Published
2026-04-27T23:24Z
EPSS history
Timeline
  • 27 APR 23:24Z
    OpenClaw 2026.2.19 through 2026.3.30 - Webhook Replay Dedupe Cache Event Suppression via Shared Authentication
    cvelistv5