CVE-2026-41337 MEDIUM

CVE-2026-41337: OpenClaw < 2026.3.31 - Callback Origin Mutation in Plivo Voice-call Replay

Vendor Openclaw
Product OpenClaw
Weakness CWE-367
Published April 23, 2026
Last update April 24, 2026
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenClaw before 2026.3.31 contains a callback origin mutation vulnerability in Plivo voice-call replay that allows attackers to mutate in-process callback origin before replay rejection. Attackers with captured valid callbacks for live calls can exploit this to manipulate callback origins during the replay process.

Key dates

02Disclosure timeline

April 23, 2026 CVE published
April 24, 2026 Record updated