CVE-2026-41402

OpenClaw < 2026.3.31 - Webhook Replay Cache Cross-Target messageId Scope Bypass

Published Apr 28, 2026 CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Description

OpenClaw before 2026.3.31 contains a scope bypass vulnerability in webhook replay cache deduplication that allows authenticated attackers to replay messages across sibling targets using the same messageId. Attackers can exploit overly broad cache keying to bypass replay protection and deliver duplicate webhook messages to unintended targets.

Analysis

Technical impact

OpenClaw prior to version 2026.3.31 allows authenticated attackers to bypass scope restrictions in the webhook replay cache. By leveraging the same messageId across different sibling targets, an attacker can trick the system into treating distinct webhook deliveries as duplicates and thus replay messages to unintended recipients. This flaw arises from overly broad cache keying and results in duplicate delivery rather than a traditional denial of service or data breach.

Affected Systems

OpenClaw technology, any installations using OpenClaw before release 2026.3.31 are vulnerable.

Risk and Exploitability

The CVSS score of 2.3 indicates low severity, and the EPSS score is not available, suggesting limited public exploitation data. The vulnerability is not listed in CISA KEV. Attackers would need valid authentication to the target system and the ability to send webhook requests with repeated messageIds in order to exploit the flaw.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OpenClaw

unaffected

Version	Status	Constraints
`0`	affected	< 2026.3.31
`2026.3.31`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

No data.

Vendor Product Versions

Openclaw

Version	Status	Scheme	Platform
`[0,2026.3.31)`	affected	generic	—
`2026.3.31`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to OpenClaw version 2026.3.31 or later, which removes the scope bypass in webhook replay cache.
Ensure that webhook integrations generate distinct messageIds for each target, preventing accidental cache key collisions.
If immediate upgrade is not possible, consider disabling or stripping the replay cache for external webhooks until a patch is applied.

Generated by OpenCVE AI on April 28, 2026 at 23:00 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-hhq4-97c2-p447	OpenClaw: Zalo webhook replay cache cross-target messageId scope bypass

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.266% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/openclaw/openclaw/commit/4d038bb242c11f39e45f6a4bde400e5fd42e4ebf
https://github.com/openclaw/openclaw/security/advisories/GHSA-hhq4-97c2-p447
https://www.vulncheck.com/advisories/openclaw-webhook-replay-cache-cross-target-messageid-scope-bypass

History

Apr 29, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 28, 2026 7:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		OpenClaw before 2026.3.31 contains a scope bypass vulnerability in webhook replay cache deduplication that allows authenticated attackers to replay messages across sibling targets using the same messageId. Attackers can exploit overly broad cache keying to bypass replay protection and deliver duplicate webhook messages to unintended targets.
Title		OpenClaw < 2026.3.31 - Webhook Replay Cache Cross-Target messageId Scope Bypass
First Time appeared		Openclaw Openclaw openclaw
Weaknesses		CWE-706
CPEs		cpe:2.3:a:openclaw:openclaw::::::node.js::*
Vendors & Products		Openclaw Openclaw openclaw
References		https://github.com/openclaw/openclaw/commit/4d038bb242c11f39e45f6a4bde400e5fd42e4ebf https://github.com/openclaw/openclaw/security/advisories/GHSA-hhq4-97c2-p447 https://www.vulncheck.com/advisories/openclaw-webhook-replay-cache-cross-target-messageid-scope-bypass
Metrics		cvssV3_1 `{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'}` cvssV4_0 `{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}`