CVE-2026-28465
CVE-2026-28465 · OpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded Headers
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by manipulating Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers.
CVSS 8.2 · Élevée · EPSS 0,4% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
voice-call
- Versions du logiciel
- ≥ 0, < 2026.2.3: Concernée (custom)
Mettez à jour vers 2026.2.3
@openclaw/voice-call npm
- Plages de versions concernées
- SEMVER: < 2026.2.3
Mettez à jour vers 2026.2.3
@clawdbot/voice-call npm
- Plages de versions concernées
- SEMVER: ≤ 2026.1.24
Aucun correctif publié
Sources originales
- https://github.com/openclaw/openclaw/security/advisories/GHSA-3m3q-x3gj-f79x
- https://github.com/openclaw/openclaw/commit/a749db9820eb6d6224032a5a34223d286d2dcc2f
- https://www.vulncheck.com/advisories/openclaw-voice-call-webhook-verification-bypass-via-forwarded-headers
- https://nvd.nist.gov/vuln/detail/CVE-2026-28465