Vulnerability Description
OpenClaw before 2026.4.2 contains an insufficient scope vulnerability in Zalo webhook replay dedupe keys that allows legitimate events from different conversations or senders to collide. Attackers can exploit weak deduplication scoping to cause silent message suppression and disrupt bot workflows across chat sessions.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openclaw | Openclaw | < 2026.4.2 |
Related Weaknesses (CWE)
References
- https://github.com/openclaw/openclaw/commit/ef7c553dd16ee579f1d1a363f5881a99726cPatch
- https://github.com/openclaw/openclaw/security/advisories/GHSA-rxmx-g7hr-8mx4Vendor Advisory
- https://www.vulncheck.com/advisories/openclaw-insufficient-scope-in-zalo-webhookThird Party Advisory
FAQ
What is CVE-2026-41354?
CVE-2026-41354 is a vulnerability with a CVSS score of 3.7 (LOW). OpenClaw before 2026.4.2 contains an insufficient scope vulnerability in Zalo webhook replay dedupe keys that allows legitimate events from different conversations or senders to collide. Attackers can...
How severe is CVE-2026-41354?
CVE-2026-41354 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-41354?
Check the references section above for vendor advisories and patch information. Affected products include: Openclaw Openclaw.