{"id":"EUVD-2026-9911","enisaUuid":"2d42eb01-f88a-3ca1-97f9-7a0631b58334","description":"OpenClaw\u0027s voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by manipulating Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers.","datePublished":"Mar 5, 2026, 9:59:41 PM","dateUpdated":"Oct 1, 2026, 3:19:53 PM","baseScore":8.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3m3q-x3gj-f79x\nhttps://github.com/openclaw/openclaw/commit/a749db9820eb6d6224032a5a34223d286d2dcc2f\nhttps://www.vulncheck.com/advisories/openclaw-voice-call-webhook-verification-bypass-via-forwarded-headers\n","aliases":"CVE-2026-28465\nGHSA-3m3q-x3gj-f79x\n","assigner":"VulnCheck","epss":0.43,"enisaIdProduct":[{"id":"5b7e3955-b214-3180-a39e-461c74bd9080","product":{"name":"voice-call","vendor":{"name":"OpenClaw"}},"product_version":"0 \u003c2026.2.3"}],"enisaIdVendor":[{"id":"b7f576e9-f5b3-32e8-abde-3fd4e5362efe","vendor":{"name":"OpenClaw"}}],"enisaIdVulnerability":[{"id":"29fc1017-51e4-37be-8d95-4757b4459e13","vulnerability":{"id":"GHSA-3m3q-x3gj-f79x","description":"OpenClaw optional voice-call plugin: webhook verification may be bypassed behind certain proxy configurations","datePublished":"Feb 17, 2026, 9:31:58 PM","dateUpdated":"Mar 6, 2026, 1:01:21 AM","baseScore":0.0,"references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3m3q-x3gj-f79x\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-28465\nhttps://github.com/openclaw/openclaw/commit/a749db9820eb6d6224032a5a34223d286d2dcc2f\nhttps://github.com/openclaw/openclaw\nhttps://github.com/openclaw/openclaw/releases/tag/v2026.2.3\nhttps://www.vulncheck.com/advisories/openclaw-voice-call-webhook-verification-bypass-via-forwarded-headers\n","enisa_id":"EUVD-2026-9911\n","aliases":"GHSA-3m3q-x3gj-f79x\nCVE-2026-28465\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:45:46 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d14b241e-22c6-3d83-b2b3-4125d84b75ab","vulnerability":{"id":"CVE-2026-28465","description":"OpenClaw\u0027s voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by manipulating Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers.","datePublished":"Mar 5, 2026, 9:59:41 PM","dateUpdated":"Oct 1, 2026, 3:19:53 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3m3q-x3gj-f79x\nhttps://github.com/openclaw/openclaw/commit/a749db9820eb6d6224032a5a34223d286d2dcc2f\nhttps://www.vulncheck.com/advisories/openclaw-voice-call-webhook-verification-bypass-via-forwarded-headers\n","enisa_id":"EUVD-2026-9911\n","assigner":"VulnCheck","epss":0.43,"dataProcessed":"Nov 11, 2026, 7:25:41 AM","vulnerabilityProduct":[{"id":"24e9c3dd-01a8-3ba2-9dae-fead3b094f92","product":{"name":"voice-call","vendor":{"name":"OpenClaw"}},"product_version":"0 \u003c2026.2.3"}],"vulnerabilityVendor":[{"id":"34df4106-fbf3-3c35-85eb-ed480d597348","vendor":{"name":"OpenClaw"}}]}}],"enisaIdAdvisory":[{"id":"05003f17-9642-38b1-922e-a616dad55f2b","advisory":{"id":"WID-SEC-W-2026-0424","description":"OpenClaw: Mehrere Schwachstellen","summary":"Ein Angreifer kann diese Schwachstellen in OpenClaw ausnutzen, um beliebigen Programmcode auszuführen, sich erhöhte Berechtigungen zu verschaffen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder andere, nicht näher bezeichnete Angriffe durchzuführen.","datePublished":"Feb 15, 2026, 11:00:00 PM","dateUpdated":"Mar 5, 2026, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0424.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-0424\n","aliases":"CVE-2026-28391\nCVE-2026-28392\nCVE-2026-28393\nCVE-2026-28395\nCVE-2026-28446\nCVE-2026-28447\nCVE-2026-28448\nCVE-2026-28450\nCVE-2026-28451\nCVE-2026-28452\nCVE-2026-28453\nCVE-2026-28454\nCVE-2026-28456\nCVE-2026-28457\nCVE-2026-28458\nCVE-2026-28459\nCVE-2026-28462\nCVE-2026-28463\nCVE-2026-28464\nCVE-2026-28465\nCVE-2026-28466\nCVE-2026-28467\nCVE-2026-28468\nCVE-2026-28469\nCVE-2026-28470\nCVE-2026-28471\nCVE-2026-28472\nCVE-2026-28473\nCVE-2026-28474\nCVE-2026-28475\nCVE-2026-28476\nCVE-2026-28477\nCVE-2026-28478\nCVE-2026-28480\nCVE-2026-28481\nCVE-2026-28482\nCVE-2026-28485\nCVE-2026-28486\nCVE-2026-29606\nCVE-2026-29609\nCVE-2026-29610\nCVE-2026-29611\nCVE-2026-29612\nCVE-2026-29613\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"9e64e429-2f43-3c23-bdea-40a6b981c0c0","product":{"name":"OpenClaw","vendor":{"name":"n/a"}}},{"id":"ac0c6626-06c1-37ad-86c8-8430f0b0d962","product":{"name":"2026.2.14","vendor":{"name":"open source"}}}]}}]}