OpenClaw vulnerabilities

CVEs whose affected-version data names the OpenClaw package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

211 CVEsRSS

CVE-2026-28465Medium· 5.9

8mo ago

OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers

OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can sp…

▾ Sunlitopenclaw · openclawEPSS 0.40%via NVD