OpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded Headers
OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by manipulating Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers.
CVE-2026-28465
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-28465
voice-call
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "OpenClaw",
"product": "voice-call",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2026.2.3",
"versionType": "custom"
}
],
"packageURL": "pkg:npm/%40openclaw/voice-call",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-28465
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #5415 · Revision 1
- Added to Heist Feed
- Publisher date