Executive brief
OpenClaw is a Node.js library for integrating with Zalo messaging and webhooks. Before version 2026.4.2, replay deduplication keys were not properly scoped across different conversations or message senders, causing legitimate messages to be silently dropped as duplicates. This can break bot workflows and cause messages to go undelivered.
Technical details
The vulnerability is a scope insufficiency (CWE-349, CWE-440) in Zalo webhook replay deduplication logic. Webhook replay dedupe keys were not strongly scoped across chat and sender dimensions, allowing legitimate events from different conversations or senders to collide and be incorrectly dropped as duplicates. This is an availability issue affecting webhook event processing in OpenClaw. The fix, present in version 2026.4.2 and commit ef7c553, properly scopes the dedupe keys across all relevant event dimensions. No authentication or special preconditions are required; the issue manifests during normal webhook processing when multiple conversations or senders generate similar events.
Affected products
- OpenClaw OpenClaw <= 2026.4.1
Timeline
- 2026-04-07: disclosed
- 2026-04-07: patched: Fix staged for 2026.4.2 release