OpenClaw prior to version 2026.3.31 allows authenticated attackers to bypass scope restrictions in the webhook replay cache. By leveraging the same messageId across different sibling targets, an attacker can trick the system into treating distinct webhook deliveries as duplicates and thus replay messages to unintended recipients. This flaw arises from overly broad cache keying and results in duplicate delivery rather than a traditional denial of service or data breach.

OpenClaw technology, any installations using OpenClaw before release 2026.3.31 are vulnerable.

The CVSS score of 2.3 indicates low severity, and the EPSS score is not available, suggesting limited public exploitation data. The vulnerability is not listed in CISA KEV. Attackers would need valid authentication to the target system and the ability to send webhook requests with repeated messageIds in order to exploit the flaw.