CVE-2026-28465: 
JavaScript vulnerability analysis and mitigation

CVE-2026-28465 is an improper authentication vulnerability in OpenClaw's optional voice-call plugin that allows remote attackers to bypass webhook verification by supplying spoofed forwarded headers. It affects @openclaw/voice-call versions before 2026.2.3 and the legacy @clawdbot/voice-call package (all versions ≤ 2026.1.24, with no patch available under that package name). The vulnerability was published on March 5, 2026, and a fix was committed on March 9, 2026. It carries a CVSS v3.1 base score of 7.5 (High) per Feedly/NVD data, though the GitHub advisory rates it as Moderate (5.9) due to higher attack complexity assumptions (GitHub Advisory, Feedly).

The root cause is classified as CWE-345 (Insufficient Verification of Data Authenticity) and CWE-290 (Authentication Bypass by Spoofing). In certain reverse-proxy or tunnel configurations, the plugin used Forwarded or X-Forwarded-* HTTP headers to reconstruct the public webhook URL for signature verification, but did not validate whether those headers originated from a trusted proxy. An attacker can directly supply crafted X-Forwarded-Host or Forwarded headers in their HTTP request, causing the plugin to reconstruct an attacker-controlled URL and accept a spoofed webhook payload as legitimate. Exploitation requires a deployment where the reverse proxy does not strip or overwrite these headers before they reach the application (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated remote attacker to inject malicious webhook payloads that the voice-call plugin processes as legitimate events, resulting in a high integrity impact. Attackers can spoof voice-call webhook events (e.g., call status updates, recordings, or control signals), potentially gaining unauthorized access to sensitive call data or triggering unauthorized actions within the plugin. Confidentiality and availability are not directly impacted, but the ability to inject arbitrary webhook events could be leveraged for further abuse of the voice-call workflow (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.033%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a specific precondition — a reverse-proxy configuration that does not strip untrusted forwarded headers — which limits the attack surface to misconfigured deployments (Feedly, GitHub Advisory).

1. Reconnaissance: Identify OpenClaw deployments with the voice-call plugin enabled and exposed behind a reverse proxy (e.g., nginx, Fly.io, ngrok) that does not strip X-Forwarded-* or Forwarded headers.
2. Craft malicious request: Prepare an HTTP POST request targeting the webhook endpoint (e.g., /voice/webhook) with a spoofed X-Forwarded-Host header set to an attacker-controlled hostname, and a webhook payload mimicking a legitimate provider event (e.g., Twilio or Plivo call status).
3. Bypass signature verification: Because the plugin reconstructs the webhook URL using the attacker-supplied forwarded header, the URL used for HMAC signature verification is attacker-controlled, allowing the attacker to compute a valid signature for their payload.
4. Inject spoofed event: Send the crafted request with the valid (attacker-computed) signature; the plugin accepts it as a legitimate webhook event and processes the malicious payload, potentially triggering unauthorized call actions or exposing call data (GitHub Advisory, Patch Commit).

• Network: Unexpected HTTP POST requests to the voice webhook endpoint (e.g., /voice/webhook) containing X-Forwarded-Host, X-Forwarded-For, or Forwarded headers with external or unknown hostnames not matching the configured public URL.
• Logs: Application logs showing webhook events accepted from IP addresses not matching configured trusted proxy IPs; webhook processing logs for call events that do not correspond to active calls in the telephony provider's dashboard.
• Application Behavior: Unexpected call control actions (e.g., hangups, transfers, or TTS playback) triggered without corresponding legitimate inbound calls from the telephony provider.

Upgrade the @openclaw/voice-call npm package to version 2026.2.3 or later, which ignores forwarded headers by default unless explicitly trusted via the new webhookSecurity configuration block. Users of the legacy @clawdbot/voice-call package should migrate to @openclaw/voice-call >= 2026.2.3, as no patch will be published under the old package name. As an immediate workaround for those unable to upgrade, strip Forwarded and X-Forwarded-* headers at the edge/reverse-proxy before they reach the application. After upgrading, configure webhookSecurity.allowedHosts and/or webhookSecurity.trustedProxyIPs to explicitly allowlist trusted hosts and proxy IPs (GitHub Advisory, Patch Commit).

The vulnerability was reported by security researcher @0x5t and disclosed via the GitHub Security Advisory program by OpenClaw maintainer steipete. The advisory was rated Moderate by the project, reflecting that exploitation requires a specific misconfigured proxy environment. Brief mentions appeared on Mastodon (via @thehackerwire) and aggregator sites such as RedPacket Security and VulnDB shortly after disclosure, but no significant broader media coverage or notable researcher commentary has been observed (GitHub Advisory).