CVE-2026-41402CWE-706

OpenClaw < 2026.3.31 - Webhook Replay Cache Cross-Target messageId Scope Bypass

Low · published April 28, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.31 contains a scope bypass vulnerability in webhook replay cache deduplication that allows authenticated attackers to replay messages across sibling targets using the same messageId. Attackers can exploit overly broad cache keying to bypass replay protection and deliver duplicate webhook messages to unintended targets.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00367 · 29.4th percentile
Weakness
CWE-706 · Use of Incorrectly-Resolved Name or Reference
Published
2026-04-28T18:09Z
EPSS history
Timeline
  • 28 APR 18:09Z
    OpenClaw < 2026.3.31 - Webhook Replay Cache Cross-Target messageId Scope Bypass
    cvelistv5