Junglewise Threat Intelligence

CVE-2026-41354: OpenClaw insufficient replay dedupe key scoping in Zalo webhooks

CVE-2026-41354 · Severity: medium · CVSS 4 · Published 2026-04-07

Technologies: Openclaw. Vendors: Openclaw.

Executive brief

OpenClaw is a Node.js library for integrating with Zalo messaging and webhooks. Before version 2026.4.2, replay deduplication keys were not properly scoped across different conversations or message senders, causing legitimate messages to be silently dropped as duplicates. This can break bot workflows and cause messages to go undelivered.

Technical details

The vulnerability is a scope insufficiency (CWE-349, CWE-440) in Zalo webhook replay deduplication logic. Webhook replay dedupe keys were not strongly scoped across chat and sender dimensions, allowing legitimate events from different conversations or senders to collide and be incorrectly dropped as duplicates. This is an availability issue affecting webhook event processing in OpenClaw. The fix, present in version 2026.4.2 and commit ef7c553, properly scopes the dedupe keys across all relevant event dimensions. No authentication or special preconditions are required; the issue manifests during normal webhook processing when multiple conversations or senders generate similar events.

Affected products

  • OpenClaw OpenClaw <= 2026.4.1

Timeline

  • 2026-04-07: disclosed
  • 2026-04-07: patched: Fix staged for 2026.4.2 release

References

Related threats