CVE-2026-28465 OpenClaw CVE debrief

Who should care

Defenders responsible for OpenClaw's voice-call plugin deployments should assess their exposure to this vulnerability and prioritize verification and updates. This includes operators, platform administrators, vulnerability management teams, and security teams who manage or are impacted by OpenClaw's voice-call plugin. They should review their deployment contexts for potential exposure and take necessary actions to prevent potential spoofing of webhook事件.

Why it matters

CVE-2026-28465 is a HIGH severity vulnerability in OpenClaw's voice-call plugin that allows remote attackers to bypass webhook verification, potentially enabling attackers to spoof webhook events. Defenders should prioritize verifying and updating OpenClaw's voice-call plugin to version 2026.2.3 or later, and assess their exposure to this vulnerability.

• Defenders need to verify and update OpenClaw's voice-call plugin to prevent potential spoofing of webhook events
• Exposure to this vulnerability may allow attackers to bypass webhook verification
• Defenders should assess their deployment contexts for potential exposure to this vulnerability

Technical summary

The vulnerability allows remote attackers to bypass webhook verification by supplying untrusted forwarded headers, potentially enabling attackers to spoof webhook events. This is due to an improper authentication vulnerability in webhook verification in OpenClaw's voice-call plugin versions before 2026.2.3. The issue arises from the plugin's handling of Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers. Defenders should prioritize verifying and updating OpenClaw's voice-call plugin to version 2026.2.3 or later.

Defensive priority

Defenders should prioritize verifying and updating OpenClaw's voice-call plugin to version 2026.2.3 or later, and assess their exposure to this vulnerability.

Recommended defensive actions

• Verify and update OpenClaw's voice-call plugin to version 2026.2.3 or later
• Assess exposure to this vulnerability
• Monitor for potential spoofing of webhook events
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. The source references include a patch, vendor advisory, and third-party advisory. Evidence is limited to public CVE and NVD sources. Defenders should verify OpenClaw's voice-call plugin version and assess exposure based on available information. No additional evidence is available beyond CVE and NVD sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.