Описание
OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by manipulating Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers.
Ссылки
- Patch
- Vendor Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2026.2.3 (исключая)
cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*
EPSS
Процентиль: 30%
0.00374
Низкий
5.9 Medium
CVSS3
7.5 High
CVSS3
Дефекты
CWE-290
CWE-290
Связанные уязвимости
CVSS3: 5.9
github
6 месяцев назад
OpenClaw optional voice-call plugin: webhook verification may be bypassed behind certain proxy configurations
EPSS
Процентиль: 30%
0.00374
Низкий
5.9 Medium
CVSS3
7.5 High
CVSS3
Дефекты
CWE-290
CWE-290