Executive brief
OpenClaw is a framework for building chatbot integrations with services like Zalo. The vulnerability affects how it deduplicates webhook events to prevent processing the same message twice. Due to weak deduplication logic, legitimate messages from different conversations or senders can be incorrectly treated as duplicates and silently suppressed, causing bot workflows to break and users to miss messages.
Technical details
This is an insufficient scope vulnerability (CWE-706) in OpenClaw's Zalo webhook replay deduplication mechanism. The dedupe keys used to identify duplicate webhook events do not account for chat session or sender dimensions, allowing legitimate events from different conversations or senders to collide. An attacker or legitimate system event can cause suppression of messages across different conversations by triggering key collisions. The vulnerability affects versions up to 2026.4.1 and is fixed in version 2026.4.2 via commit ef7c553dd16ee579f1d1a363f5881a99726c1412, which adds proper event dimension scoping.
Affected products
- OpenClaw OpenClaw < 2026.4.2
Timeline
- 2026-04-02: disclosed: Advisory GHSA-rxmx-g7hr-8mx4 published
- 2026-04-24: patched: Fix released in OpenClaw 2026.4.2