CVE-2026-35618: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-35618 is a replay identity bypass vulnerability in OpenClaw's Plivo V2 signature verification component, classified under CWE-294 (Authentication Bypass by Capture-replay). It affects all OpenClaw npm package versions before 2026.3.23 and was published on April 9, 2026. The flaw allows unauthenticated network attackers to bypass replay protection by making unsigned query-only modifications to legitimately signed requests. It carries a CVSS v3.1 base score of 6.5 (High) and a CVSS v4.0 base score of 8.3 (High) (Github Advisory, Feedly).

The root cause resides in extensions/voice-call/src/webhook-security.ts, where the Plivo V2 replay key was derived by hashing the full verification URL — including query string parameters — rather than the canonicalized base URL (scheme + host + path only). Because Plivo V2 signatures authenticate only the base URL plus a nonce, an attacker who intercepts a legitimately signed request can alter query parameters (e.g., changing ?flow=answer to ?flow=getinput) to produce a distinct replay key, effectively minting a new verifiedRequestKey that passes replay detection as a fresh, unverified request. The fix (commit b0ce53a) introduced createPlivoV2ReplayKey(), which calls getBaseUrlNoQuery(url) before hashing, ensuring query-only variants of the same signed request map to the same replay key and are correctly flagged as replays (Github Advisory, Fix Commit).

Successful exploitation allows an attacker to forge verified request keys without possessing the Plivo auth token, enabling unauthorized actions to be performed as if they were legitimate, cryptographically verified webhook requests. The primary impact is high integrity compromise — an attacker can inject or replay voice-call webhook events (e.g., manipulating call flow logic) — with a low confidentiality impact from potential exposure of request metadata. Availability is not directly affected, and there is no evidence of lateral movement potential beyond the voice-call webhook processing context (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. Exploitation requires high attack complexity — the attacker must first intercept or observe a legitimately signed Plivo V2 webhook request before crafting a query-modified variant (Feedly).

1. Intercept a signed request: Position to observe or capture a legitimate Plivo V2 webhook POST request sent to the target OpenClaw instance (e.g., via network interception or access to request logs). The request will contain x-plivo-signature-v2 and x-plivo-signature-v2-nonce headers.
2. Identify the base URL and query parameters: Extract the full verification URL (e.g., https://example.com/voice/webhook?flow=answer&callId=abc) and note that the signature covers only the base URL (https://example.com/voice/webhook) plus the nonce.
3. Craft a query-modified variant: Construct a new request using the same headers (x-plivo-signature-v2, x-plivo-signature-v2-nonce, host, x-forwarded-proto) and body, but with modified query parameters (e.g., change ?flow=answer to ?flow=getinput).
4. Submit the modified request: Send the crafted POST request to the OpenClaw webhook endpoint. The vulnerable code will validate the signature against the base URL (which matches), derive a new replay key from the modified full URL, and treat the request as a fresh verified event — bypassing replay protection.
5. Achieve unauthorized action: The forged request is processed as a legitimate Plivo webhook event, allowing the attacker to manipulate call flow logic or inject arbitrary call state transitions (Github Advisory, Fix Commit).

• Network: Repeated POST requests to the Plivo voice webhook endpoint (e.g., /voice/webhook) with identical x-plivo-signature-v2 and x-plivo-signature-v2-nonce header values but differing query string parameters across requests.
• Logs: Application logs showing multiple successful webhook verifications (ok: true) for requests sharing the same nonce but different query strings; absence of isReplay: true flags on what should be duplicate requests in pre-patch versions.
• Application Behavior: Unexpected or duplicate call flow state transitions (e.g., repeated answer, getinput, or hangup events) for the same call UUID that do not correspond to actual telephony events.

Upgrade OpenClaw to version 2026.3.23 or later (latest confirmed: v2026.3.23-2), which includes the fix in commit b0ce53a that stabilizes Plivo V2 replay keys by canonicalizing the URL before hashing. No configuration-based workaround is available for unpatched versions. As an additional defense-in-depth measure, monitor Plivo V2 webhook logs for requests sharing the same nonce with differing query parameters, and consider implementing application-layer deduplication on call UUIDs (Github Advisory, Fix Commit).

The vulnerability was reported by researcher @smaeljaish771 and sponsored by KeenSecurityLab, as credited in the official GitHub Security Advisory. The advisory was initially published as a duplicate (GHSA-j56c-wpqm-h24x) and subsequently withdrawn in favor of the canonical advisory GHSA-cg6c-q2hx-69h7. VulnCheck independently documented the issue in their advisories database. No significant broader media coverage or social media discussion has been observed (Github Advisory, Feedly).