Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-32053
6.5 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): LOW
- Availability impact (A): LOW
OpenClaw < 2026.2.23 - Twilio Webhook Replay Bypass via Randomized Event ID Normalization
OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are randomized per parse, allowing replay events to bypass manager dedupe checks. Attackers can replay Twilio webhook events to trigger duplicate or stale call-state transitions, potentially causing incorrect call handling and state corruption.
References
-
GitHub Security Advisory (GHSA-vqx8-9xxw-f2m7) third-party-advisory
-
Patch Commit patch
Affected products
OpenClaw
- ==2026.2.23
- <2026.2.23
Package maintainers
-
@chrisportela Chris Portela <chris@chrisportela.com>