CVE-2026-41402

תיאור (מקור, אנגלית)

OpenClaw before 2026.3.31 contains a scope bypass vulnerability in webhook replay cache deduplication that allows authenticated attackers to replay messages across sibling targets using the same messageId. Attackers can exploit overly broad cache keying to bypass replay protection and deliver duplicate webhook messages to unintended targets.

מדדים

CVSS 3.1

5.4 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CVSS 4.0

2.3 (LOW) מקור הציון: CNA CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-30/7/2026

CWE

CWE-706

מוצרים מושפעים

openclaw: openclaw

קישורים

• https://github.com/openclaw/openclaw/security/advisories/GHSA-hhq4-97c2-p447 Vendor Advisory
• https://github.com/openclaw/openclaw/commit/4d038bb242c11f39e45f6a4bde400e5fd4‮… Patch
• https://www.vulncheck.com/advisories/openclaw-webhook-replay-cache-cross-targe‮… Third Party Advisory