Junglewise Threat Intelligence

CVE-2026-28465: OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows r

CVE-2026-28465 · Severity: medium · CVSS 5.9 · Published 2026-03-05

Technologies: Openclaw. Vendors: Openclaw, npm.

Executive brief

OpenClaw's optional voice-call plugin handles incoming webhook calls for voice integration features. In certain proxy or forwarding setups, the plugin may incorrectly trust forwarded headers (like X-Forwarded-For) that are not validated by a trusted proxy, allowing an attacker to forge webhook requests and inject spoofed voice-call events into the system. This could disrupt voice-call functionality or inject malicious events into downstream processing.

Technical details

The vulnerability stems from improper authentication of webhook requests in OpenClaw's voice-call plugin (CWE-287, CWE-290, CWE-345). The root cause is that some deployments implicitly trust forwarded headers (Forwarded / X-Forwarded-* headers) when determining request properties used during webhook signature verification. If those headers are not overwritten by a trusted proxy, a client can supply them directly to influence verification logic and bypass authentication checks. The attack requires network access to the webhook endpoint but no privileges or user interaction. Patched versions ignore forwarded headers by default unless explicitly allowlisted in configuration. The fix was released in @openclaw/voice-call >= 2026.2.3; the legacy package @clawdbot/voice-call has no patched version published and users must migrate. Workaround: strip Forwarded and X-Forwarded-* headers at the edge proxy.

Affected products

  • OpenClaw @openclaw/voice-call < 2026.2.3
  • OpenClaw @clawdbot/voice-call <= 2026.1.24

Timeline

  • 2026-02-17: disclosed: Advisory published as GHSA-3m3q-x3gj-f79x
  • 2026-02-03: patched: Fix commit a749db9820eb6d6224032a5a34223d286d2dcc2f (hardening webhook verification)
  • 2026-02-17: other: CVE-2026-28465 assigned

References

Related threats