CVE-2026-35618: OpenClaw Plivo V2 replay bypass

CISO Take

CVE-2026-35618 is an authentication replay vulnerability in OpenClaw's Plivo V2 webhook signature verification where the replay deduplication key is derived from the full URL including mutable query strings rather than a canonicalized base URL, allowing an attacker who has captured any prior legitimate signed request to mint unlimited new verified requests by altering only query parameters — all while the original signature remains intact. While not in CISA KEV, the EPSS score places this in the top 80th percentile for exploitation likelihood, and OpenClaw's documented history of malicious skill abuse for credential exfiltration (AIID #1368) makes unauthorized agent invocation a credible, compounding threat model. Integrity impact is rated HIGH in the CVSS vector, meaning a successful exploit can fully subvert webhook-driven agent workflows, triggering unintended tool calls with attacker-controlled parameters. Patch to OpenClaw 2026.3.23 immediately; as an interim control, restrict inbound Plivo webhook IPs to Plivo's published ranges and audit agent tool permissions for least privilege.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

Medium severity with elevated contextual risk for AI agent deployments. CVSS 6.5 with high attack complexity (AC:H requires a prior captured signed request) limits opportunistic exploitation, but the I:H integrity score indicates a successful exploit can fully compromise webhook-driven agent actions. With 4 downstream dependents the blast radius is narrow, but OpenClaw's role as an AI agent orchestrator means post-exploitation impact is bounded by whatever tools the agent can invoke — which in practice may include external APIs, data stores, or communication channels. No public exploit or scanner template exists, moderating immediate risk. The 396 historical CVEs in the same package signal a pattern of security debt that warrants elevated scrutiny of this component.

How does the attack unfold?

Capture

Attacker intercepts or obtains from logs a legitimate Plivo V2 signed webhook request previously delivered to an OpenClaw endpoint, including the full URL with query parameters and the Plivo signature header.

AML.T0006

Query Manipulation

Attacker crafts a modified variant of the captured request by altering or appending query parameters (e.g., callStatus, callerId) while preserving the original Plivo V2 signature intact.

AML.T0049

Replay Key Bypass

OpenClaw derives a new, previously-unseen replay key from the modified URL, treats the request as a fresh unique event rather than a replay, and accepts it as legitimately signed by Plivo.

AML.T0091

Unauthorized Agent Invocation

The forged-but-verified webhook triggers OpenClaw agent actions or tool calls with attacker-controlled parameters, enabling unauthorized workflow execution, external API calls, or data access.

AML.T0053

Capture

Attacker intercepts or obtains from logs a legitimate Plivo V2 signed webhook request previously delivered to an OpenClaw endpoint, including the full URL with query parameters and the Plivo signature header.

AML.T0006

Query Manipulation

Attacker crafts a modified variant of the captured request by altering or appending query parameters (e.g., callStatus, callerId) while preserving the original Plivo V2 signature intact.

AML.T0049

Replay Key Bypass

OpenClaw derives a new, previously-unseen replay key from the modified URL, treats the request as a fresh unique event rather than a replay, and accepts it as legitimately signed by Plivo.

AML.T0091

Unauthorized Agent Invocation

The forged-but-verified webhook triggers OpenClaw agent actions or tool calls with attacker-controlled parameters, enabling unauthorized workflow execution, external API calls, or data access.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C Low

I High

A None

What should I do?

5 steps

Patch: Upgrade OpenClaw to 2026.3.23 or later — commits b0ce53a and 630f147 fix the replay key canonicalization to strip query strings before key derivation.
Workaround (pre-patch): Restrict inbound webhook endpoints to Plivo's published IP allowlist at the network or WAF layer to prevent non-Plivo sources from submitting requests.
Least privilege audit: Review and reduce agent tool permissions — disable any tool that isn't actively required, particularly those with write or external-API capabilities.
Detection: Alert on repeated POST requests to the same OpenClaw webhook path with identical bodies but differing query strings within a short time window, or unexpected spikes in agent tool invocation rates.
Consider temporarily disabling Plivo integrations in environments where patching is delayed and the agent has access to high-impact tools.

How is it classified?

Auth Bypass Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0091 - Use Alternate Authentication Material

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.9.3 - AI system interfaces and security controls

NIST AI RMF

MANAGE-2.2 - AI system integrity and access control

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-35618?

CVE-2026-35618 is an authentication replay vulnerability in OpenClaw's Plivo V2 webhook signature verification where the replay deduplication key is derived from the full URL including mutable query strings rather than a canonicalized base URL, allowing an attacker who has captured any prior legitimate signed request to mint unlimited new verified requests by altering only query parameters — all while the original signature remains intact. While not in CISA KEV, the EPSS score places this in the top 80th percentile for exploitation likelihood, and OpenClaw's documented history of malicious skill abuse for credential exfiltration (AIID #1368) makes unauthorized agent invocation a credible, compounding threat model. Integrity impact is rated HIGH in the CVSS vector, meaning a successful exploit can fully subvert webhook-driven agent workflows, triggering unintended tool calls with attacker-controlled parameters. Patch to OpenClaw 2026.3.23 immediately; as an interim control, restrict inbound Plivo webhook IPs to Plivo's published ranges and audit agent tool permissions for least privilege.

Is CVE-2026-35618 actively exploited?

No confirmed active exploitation of CVE-2026-35618 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35618?

1. Patch: Upgrade OpenClaw to 2026.3.23 or later — commits b0ce53a and 630f147 fix the replay key canonicalization to strip query strings before key derivation. 2. Workaround (pre-patch): Restrict inbound webhook endpoints to Plivo's published IP allowlist at the network or WAF layer to prevent non-Plivo sources from submitting requests. 3. Least privilege audit: Review and reduce agent tool permissions — disable any tool that isn't actively required, particularly those with write or external-API capabilities. 4. Detection: Alert on repeated POST requests to the same OpenClaw webhook path with identical bodies but differing query strings within a short time window, or unexpected spikes in agent tool invocation rates. 5. Consider temporarily disabling Plivo integrations in environments where patching is delayed and the agent has access to high-impact tools.

What systems are affected by CVE-2026-35618?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, webhook-triggered agent workflows, voice/SMS-integrated AI pipelines.

What is the CVSS score for CVE-2026-35618?

CVE-2026-35618 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.28%.

What is the AI security impact?

Affected AI Architectures

agent frameworkswebhook-triggered agent workflowsvoice/SMS-integrated AI pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0091 Use Alternate Authentication Material

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.9.3

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

OpenClaw before 2026.3.23 contains a replay identity vulnerability in Plivo V2 signature verification that allows attackers to bypass replay protection by modifying query parameters. The verification path derives replay keys from the full URL including query strings instead of the canonicalized base URL, enabling attackers to mint new verified request keys through unsigned query-only changes to signed requests.

Exploitation Scenario

An attacker monitoring network traffic, operating a man-in-the-middle position, or with access to webhook delivery logs captures a legitimate Plivo V2 signed request destined for an OpenClaw AI agent endpoint — for example, an incoming call webhook with parameters callerId and callStatus. They craft a variant by appending or modifying query parameters (e.g., changing callStatus=completed to callStatus=ringing or adding a spurious parameter) while leaving the Plivo V2 signature header unchanged. Because OpenClaw derives the replay key from the full URL including query strings, the modified URL produces a novel, unseen key that is not flagged as a duplicate, and the request is accepted as a legitimately signed, unreplayed event. The agent processes this attacker-manipulated webhook as genuine, potentially triggering a phone call action, initiating a downstream workflow, or invoking agent tools — all with attacker-supplied parameter values but carrying the implicit trust of a verified Plivo signature.

Weaknesses (CWE)

CWE-294 Authentication Bypass by Capture-replay

CWE-294 — Authentication Bypass by Capture-replay: A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

[Architecture and Design] Utilize some sequence or time stamping functionality along with a checksum which takes this into account in order to ensure that messages can be parsed only once.
[Architecture and Design] Since any attacker who can listen to traffic can see sequence numbers, it is necessary to sign messages with some kind of cryptography to ensure that sequence numbers are not simply doctored along with content.

Source: MITRE CWE corpus.