Medium severity6.5NVD Advisory· Published Apr 9, 2026· Updated Apr 17, 2026
CVE-2026-35618
CVE-2026-35618
Description
OpenClaw before 2026.3.23 contains a replay identity vulnerability in Plivo V2 signature verification that allows attackers to bypass replay protection by modifying query parameters. The verification path derives replay keys from the full URL including query strings instead of the canonicalized base URL, enabling attackers to mint new verified request keys through unsigned query-only changes to signed requests.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | < 2026.3.23 | 2026.3.23 |
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87nvdPatchWEB
- github.com/openclaw/openclaw/commit/b0ce53a79cf63834660270513e26d921899b4e5bnvdPatchWEB
- github.com/advisories/GHSA-cg6c-q2hx-69h7ghsaADVISORY
- github.com/openclaw/openclaw/security/advisories/GHSA-cg6c-q2hx-69h7nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-35618ghsaADVISORY
- www.vulncheck.com/advisories/openclaw-replay-identity-drift-via-query-only-variants-in-plivo-v2-verificationnvdThird Party AdvisoryWEB
News mentions
0No linked articles in our index yet.