CVE-2026-32053: OpenClaw webhook replay bypass

CISO Take

OpenClaw before version 2026.2.23 fails to deduplicate Twilio webhook events because event IDs are re-randomized on every parse pass, meaning any unauthenticated network attacker who captures a single legitimate webhook payload can replay it indefinitely and trigger duplicate or stale call-state transitions in the AI agent. The CVSS 6.5 vector requires zero privileges, no user interaction, and low complexity over the network — EPSS places it in the top 75th percentile for exploitation likelihood, and CWE-294 capture-replay attacks are well within script-kiddie reach. The integrity impact extends beyond telephony: if corrupted call-state feeds downstream LLM decision logic (summaries, escalations, follow-up workflows), the blast radius grows beyond the immediate state corruption. Upgrade to OpenClaw ≥ 2026.2.23 immediately; as an interim control, enforce Twilio's X-Twilio-Signature validation and implement idempotency keying on raw event SIDs at your API gateway before they reach the application layer.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium severity overall, but elevated in AI agent voice pipeline deployments. The zero-authentication, network-accessible attack vector with low complexity makes exploitation technically trivial — any attacker with access to a single webhook delivery can mount the attack. Impact is bounded to integrity and availability (C:N/I:L/A:L), but in agentic workflows where call-state drives automated decisions, corrupted state can trigger real downstream consequences disproportionate to the CVSS score. With only 4 downstream dependents, the supply chain blast radius is contained; however, the OpenClaw package carries 396 total CVEs and active attacker interest in its ecosystem (AIID #1368 documents credential-stealing skills abuse), making exploitation of this lower-bar flaw a realistic threat.

How does the attack unfold?

Webhook Observation

Attacker captures a legitimate Twilio webhook POST to the OpenClaw endpoint via network interception, log access, or a compromised ancillary service, acquiring the full event payload.

AML.T0006

Replay Submission

Attacker re-POSTs the captured payload one or more times; OpenClaw re-randomizes the event ID on each parse, causing the deduplication manager to accept each replay as a distinct new event.

AML.T0049

Agent State Corruption

OpenClaw processes each replayed event and fires call-state transition handlers repeatedly, corrupting the agent's internal call model with duplicate or temporally inconsistent state.

AML.T0053

Downstream Impact

Corrupted call state propagates into downstream AI workflows — LLM summary calls receive stale context, billing and CRM integrations receive duplicate events, and automated follow-up actions execute multiple times.

AML.T0048

Webhook Observation

Attacker captures a legitimate Twilio webhook POST to the OpenClaw endpoint via network interception, log access, or a compromised ancillary service, acquiring the full event payload.

AML.T0006

Replay Submission

Attacker re-POSTs the captured payload one or more times; OpenClaw re-randomizes the event ID on each parse, causing the deduplication manager to accept each replay as a distinct new event.

AML.T0049

Agent State Corruption

OpenClaw processes each replayed event and fires call-state transition handlers repeatedly, corrupting the agent's internal call model with duplicate or temporally inconsistent state.

AML.T0053

Downstream Impact

Corrupted call state propagates into downstream AI workflows — LLM summary calls receive stale context, billing and CRM integrations receive duplicate events, and automated follow-up actions execute multiple times.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I Low

A Low

What should I do?

5 steps

Patch: Upgrade OpenClaw to version ≥ 2026.2.23, which fixes event ID normalization to be deterministic per event.
Immediate workaround: Implement idempotency enforcement at the API gateway or reverse proxy using the raw Twilio CallSid and EventSid headers before requests reach OpenClaw — reject any duplicate SID within a configurable TTL window (e.g., 300 seconds).
Enable Twilio webhook signature validation using X-Twilio-Signature HMAC-SHA1 verification — this does not fix the deduplication bug but eliminates forged replays (captured legitimate replays remain a risk until patched).
Restrict webhook endpoint access to Twilio's published IP ranges via firewall or load balancer ACL.
Detection: Alert on duplicate CallSid or EventSid values appearing in webhook ingestion logs within any 60-second window; treat as active replay attempt.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass DoS Agent AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0091 - Use Alternate Authentication Material

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

ISO 42001

A.6.2 - AI System Risk Management — Input Integrity

NIST AI RMF

MANAGE 2.4 - Residual risks are managed

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32053?

OpenClaw before version 2026.2.23 fails to deduplicate Twilio webhook events because event IDs are re-randomized on every parse pass, meaning any unauthenticated network attacker who captures a single legitimate webhook payload can replay it indefinitely and trigger duplicate or stale call-state transitions in the AI agent. The CVSS 6.5 vector requires zero privileges, no user interaction, and low complexity over the network — EPSS places it in the top 75th percentile for exploitation likelihood, and CWE-294 capture-replay attacks are well within script-kiddie reach. The integrity impact extends beyond telephony: if corrupted call-state feeds downstream LLM decision logic (summaries, escalations, follow-up workflows), the blast radius grows beyond the immediate state corruption. Upgrade to OpenClaw ≥ 2026.2.23 immediately; as an interim control, enforce Twilio's X-Twilio-Signature validation and implement idempotency keying on raw event SIDs at your API gateway before they reach the application layer.

Is CVE-2026-32053 actively exploited?

No confirmed active exploitation of CVE-2026-32053 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32053?

1. Patch: Upgrade OpenClaw to version ≥ 2026.2.23, which fixes event ID normalization to be deterministic per event. 2. Immediate workaround: Implement idempotency enforcement at the API gateway or reverse proxy using the raw Twilio CallSid and EventSid headers before requests reach OpenClaw — reject any duplicate SID within a configurable TTL window (e.g., 300 seconds). 3. Enable Twilio webhook signature validation using X-Twilio-Signature HMAC-SHA1 verification — this does not fix the deduplication bug but eliminates forged replays (captured legitimate replays remain a risk until patched). 4. Restrict webhook endpoint access to Twilio's published IP ranges via firewall or load balancer ACL. 5. Detection: Alert on duplicate CallSid or EventSid values appearing in webhook ingestion logs within any 60-second window; treat as active replay attempt.

What systems are affected by CVE-2026-32053?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, voice and telephony AI pipelines, event-driven AI workflows.

What is the CVSS score for CVE-2026-32053?

CVE-2026-32053 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

agent frameworksvoice and telephony AI pipelinesevent-driven AI workflows

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0091 Use Alternate Authentication Material

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2

NIST AI RMF: MANAGE 2.4

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are randomized per parse, allowing replay events to bypass manager dedupe checks. Attackers can replay Twilio webhook events to trigger duplicate or stale call-state transitions, potentially causing incorrect call handling and state corruption.

Exploitation Scenario

An attacker monitors network traffic at a vantage point between Twilio's infrastructure and the target deployment, or accesses webhook delivery logs through a compromised ancillary service. They capture a legitimate 'call-completed' webhook payload including its Twilio-issued event fields. They then POST this identical payload to the OpenClaw webhook endpoint multiple times in succession. Because OpenClaw re-randomizes the parsed event ID on each ingestion, its deduplication manager treats each replay as a novel event and executes the associated call-state transition handler repeatedly. The agent fires 'call ended' cleanup workflows multiple times: billing records are duplicated, summary LLM calls are re-issued with stale state, and follow-up actions (e.g., CRM updates, automated callbacks) execute redundantly. In a targeted scenario, an attacker replays a 'call-answered' event after the call has terminated, forcing the agent into an inconsistent live-call state that corrupts all subsequent handling until a manual reset.

Weaknesses (CWE)

CWE-294 Authentication Bypass by Capture-replay

CWE-294 — Authentication Bypass by Capture-replay: A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

[Architecture and Design] Utilize some sequence or time stamping functionality along with a checksum which takes this into account in order to ensure that messages can be parsed only once.
[Architecture and Design] Since any attacker who can listen to traffic can see sequence numbers, it is necessary to sign messages with some kind of cryptography to ensure that sequence numbers are not simply doctored along with content.

Source: MITRE CWE corpus.