CVE-2026-28465: OpenClaw voice-call: webhook auth bypass via headers

MEDIUM

Published March 5, 2026

CISO Take

OpenClaw's voice-call plugin (versions before 2026.2.3) trusts Forwarded and X-Forwarded-* headers when verifying incoming webhooks, so a remote attacker can spoof webhook events when the plugin sits behind a reverse proxy that implicitly trusts those headers. Real-world risk is moderate: CVSS is 5.9 with high attack complexity, EPSS is 0.7% (top 48%), the CVE is not in CISA KEV, there is no public exploit or Nuclei template, and CISA SSVC says TRACK. The integrity impact is the concern, since forged events could drive voice-agent behavior or call-state logic. Blast radius is small, with only 3 downstream dependents, but the package has 579 other CVEs, which signals weak security hygiene. Upgrade to 2026.2.3 or later (patch commit a749db9), and make sure your reverse proxy strips client-supplied forwarded headers.

Sources:NVDEPSSGitHub AdvisoryVulnCheckATLASCISA SSVC

What is the risk?

Medium overall. Exploitation is network-reachable with no privileges or user interaction, but it needs a specific reverse-proxy configuration that trusts forwarded headers, which explains the high attack complexity. Impact is integrity only (I:H), with no confidentiality or availability effect. EPSS is low (0.00702), there is no public exploit and no KEV listing, so near-term mass exploitation is unlikely. Exposure grows if the webhook endpoint is internet-facing and agent actions depend on webhook events.

How does the attack unfold?

Reconnaissance

Attacker identifies a publicly reachable OpenClaw voice-call webhook endpoint behind a reverse proxy that trusts forwarded headers.

AML.T0006

Initial Access

Attacker sends crafted requests with spoofed Forwarded or X-Forwarded-* headers that pass the plugin's webhook verification.

AML.T0049

Event Spoofing

Forged provider events are accepted as legitimate, letting the attacker impersonate the telephony provider.

AML.T0073

Impact

False call or transcript data corrupts agent workflows and may trigger unintended downstream actions.

Reconnaissance

Attacker identifies a publicly reachable OpenClaw voice-call webhook endpoint behind a reverse proxy that trusts forwarded headers.

AML.T0006

Initial Access

Attacker sends crafted requests with spoofed Forwarded or X-Forwarded-* headers that pass the plugin's webhook verification.

AML.T0049

Event Spoofing

Forged provider events are accepted as legitimate, letting the attacker impersonate the telephony provider.

AML.T0073

Impact

False call or transcript data corrupts agent workflows and may trigger unintended downstream actions.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
3 dependents32% patched~5d to patchFull package profile →
OpenClaw	pip	—	No patch
3 dependents32% patched~5d to patchFull package profile →

How severe is it?

CVSS 3.1

5.9 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CNone

IHigh

ANone

What should I do?

1 step

1) Upgrade the voice-call plugin to 2026.2.3 or later (see GHSA-3m3q-x3gj-f79x and commit a749db9). 2) Configure the reverse proxy to strip or overwrite inbound Forwarded and X-Forwarded-* headers from untrusted clients, and only trust them from known proxy IPs. 3) Enforce provider signature validation (for example HMAC signatures) on webhook endpoints in addition to URL-based checks. 4) Restrict the webhook endpoint by IP allowlist to the telephony provider's ranges. 5) Detection: alert on webhook requests with forwarded headers that do not originate from your proxy, on events with missing or invalid provider signatures, and on call events with no matching call record at the provider.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassSocial EngineeringPluginAgentAPIAML.T0049- Exploit Public-Facing Application AML.T0073- Impersonation AML.T0096- AI Service API

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks are managed

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-28465?

Is CVE-2026-28465 actively exploited?

No confirmed active exploitation of CVE-2026-28465 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-28465?

1) Upgrade the voice-call plugin to 2026.2.3 or later (see GHSA-3m3q-x3gj-f79x and commit a749db9). 2) Configure the reverse proxy to strip or overwrite inbound Forwarded and X-Forwarded-* headers from untrusted clients, and only trust them from known proxy IPs. 3) Enforce provider signature validation (for example HMAC signatures) on webhook endpoints in addition to URL-based checks. 4) Restrict the webhook endpoint by IP allowlist to the telephony provider's ranges. 5) Detection: alert on webhook requests with forwarded headers that do not originate from your proxy, on events with missing or invalid provider signatures, and on call events with no matching call record at the provider.

What systems are affected by CVE-2026-28465?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, voice AI agents, webhook-driven integrations, reverse-proxied AI services.

What is the CVSS score for CVE-2026-28465?

CVE-2026-28465 has a CVSS v3.1 base score of 5.9 (MEDIUM). The EPSS exploitation probability is 0.43%.

What is the AI security impact?

Affected AI Architectures

agent frameworksvoice AI agentswebhook-driven integrationsreverse-proxied AI services

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0073Impersonation

AML.T0096AI Service API

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof webhook events by manipulating Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers.

Exploitation Scenario

An organization runs an OpenClaw-based voice agent behind nginx, which passes client X-Forwarded-* headers through unchanged. The attacker finds the public webhook URL, then sends crafted POST requests with forged Forwarded or X-Forwarded-Host/Proto headers that match the values the plugin expects for signature or origin verification. The plugin accepts the requests as legitimate provider events. The attacker injects fake call-completed or transcript events, which push false data into the agent pipeline and may trigger downstream actions such as tool calls, CRM updates or escalations.

Weaknesses (CWE)

CWE-290Authentication Bypass by Spoofing

CWE-290 — Authentication Bypass by Spoofing: This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Source: MITRE CWE corpus.