CVE-2026-28465 json
OpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded Headers
published 8mo ago modified last mo. also GHSA-3m3q-x3gj-f79x , EUVD-2026-9911
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by manipulating Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers.
Patch / fix
- npm @openclaw/voice-call 2026.2.3
- OpenClaw voice-call 2026.2.3
Is CVE-2026-28465 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 8mo ago
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.2 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| CNA | 4.0 | 8.2 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @openclaw/voice-call | <2026.2.3 |
2026.2.3 |
| npm | @clawdbot/voice-call | <=2026.1.24 |
no fix listed |
Affected products
- OpenClaw voice-call
Classification
References
-
github.com
/openclaw/openclaw/commit/a749db9820eb6d6224032a5a34223d286d2dcc2f
patch, web
-
github.com
/openclaw/openclaw/security/advisories/GHSA-3m3q-x3gj-f79x
vendor-advisory, web
-
vulncheck.com
/advisories/openclaw-voice-call-webhook-verification-bypass-via-forwarded-headers
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-28465
advisory
-
github.com
/openclaw/openclaw
package
-
github.com
/openclaw/openclaw/releases/tag/v2026.2.3
web
Sources
- CVE List CVE-2026-28465
- GitHub Advisory GHSA-3m3q-x3gj-f79x
- NVD CVE-2026-28465
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.