High severity · published Mar 5, 2026
CVE-2026-28465
OpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded Headers
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by manipulating Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VO
voice-call · OpenClaw
before 2026.2.3 · source: vendor
OP
Openclaw · Openclaw
before 2026.2.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-28465
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-28465
vendor-advisory
https://github.com/openclaw/openclaw/security/advisories/GHSA-3m3q-x3gj-f79x
patch
https://github.com/openclaw/openclaw/commit/a749db9820eb6d6224032a5a34223d286d2dcc2f
third-party-advisory
https://www.vulncheck.com/advisories/openclaw-voice-call-webhook-verification-bypass-via-forwarded-headers
More from voice-call
8.8
CVE-2026-100544
openclaw voice-call before 2026.8.1 Authorization Bypass
7.5
CVE-2026-32062
OpenClaw 2026.2.21-2 < 2026.2.22 - Unauthenticated WebSocket Resource Exhaustion via Media Stream