CVE-2026-28465

Executive Summary

CVE-2026-28465 is an improper authentication vulnerability in OpenClaw's voice-call plugin (versions prior to 2026.2.3) that permits remote attackers to bypass webhook verification by supplying crafted Forwarded or X-Forwarded-* headers. The flaw affects deployments where OpenClaw voice-call instances sit behind reverse proxies that implicitly trust these headers without sanitization. Exploitation allows unauthenticated attackers to spoof legitimate webhook events, potentially leading to unauthorized actions, service disruption, or data integrity compromise. The vulnerability carries a CVSS score of 8.2 (High), and while no public exploit code is currently available, the attack vector is readily accessible over the network with no authentication required.

Technical Analysis

The vulnerability manifests as an improper authentication flaw in the webhook verification mechanism of the OpenClaw voice-call plugin. Webhook verification is a security control designed to confirm that incoming HTTP requests originate from a legitimate source (e.g., a telephony provider or voice carrier) before processing event data. This verification commonly relies on validating the originating IP address or a shared secret derived from the sender's identity. In this case, the verification logic trusts values supplied via Forwarded or X-Forwarded-* headers to determine the source of the request.

The root cause is a trust boundary violation: the application treats user-controllable HTTP headers as authoritative evidence of the request's origin. In standard HTTP architecture, intermediary proxies populate X-Forwarded-For, X-Forwarded-Host, Forwarded, and related headers to convey the original client's information to downstream servers. However, when the application environment permits direct client access to the reverse proxy (or the proxy does not overwrite incoming forwarded headers), an attacker can supply arbitrary values in these headers without triggering proxy intervention.

Specifically, if the voice-call plugin checks the source IP address of incoming webhook requests by reading they value from a forwarded header — rather than from the socket-level peer address or a properly configured proxy chain — an attacker can set that header to any IP address, including one that matches the expected provider's source address. The verification passes because the application believes the request originated from a trusted source, even though the attacker never controlled the actual network connection.

The attack is only effective in reverse-proxy configurations that pass incoming forwarded headers unchanged to the backend application. Many proxies default to appending rather than overwriting, but if configured with trust proxy semantics (or equivalent permissive settings) that accept client-supplied header values, the backend receives untrusted values as if they were legitimate. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) confirms the attack is network-exploitable, requires low complexity, needs no privileges or user interaction, and has a scope change — meaning the compromised component may impact resources beyond the application's security boundary.

Insufficient technical detail is available regarding the exact function names, class names, or URL endpoints involved in the verification logic, as the advisory does not disclose these specifics. However, the vulnerability class (CWE-287: Improper Authentication) and the mechanism (trusting unverified forwarded headers) are well-established patterns seen in numerous web applications and API gateway misconfigurations.

Exploitation Scenarios

Attack Chain Overview:

1. Reconnaissance/Target Identification: The attacker identifies an OpenClaw voice-call deployment exposed to the internet, typically by scanning for the application's distinctive HTTP responses, API endpoints, or product-specific error messages. Shodan-style reconnaissance using fingerprints associated with OpenClaw or its voice-call plugin could reveal exposed instances. The attacker would also need to ascertain the reverse-proxy configuration — specifically whether forwarded headers are accepted from clients directly without overwriting.

2. Triggering the Vulnerability Class: The attacker crafts raw HTTP requests to the webhook endpoint (the specific endpoint is not disclosed in available data). The requests include Forwarded: for=<trusted-provider-IP> or X-Forwarded-For: <trusted-provider-IP> headers, set to values that the application would normally expect from legitimate voice-carrier webhooks. Because the application trusts these headers for source verification, the spoofed headers pass the authentication check.

3. Payload/Execution Method: At the vulnerability-class level, the payload is a crafted HTTP request containing forged forwarded headers. No authentication token, secret, or cryptographic signature is required, as the verification mechanism relies solely on the spoofable header values. The attacker sends requests that mimic legitimate webhook events — for example, call-status updates, call-recording notifications, or interactive voice response (IVR) triggers.

4. Post-Exploitation Impact: Successful spoofing grants the attacker the ability to submit arbitrary webhook events to the voice-call plugin. Depending on the event types the plugin processes, the impact could include: injecting false call records (data integrity compromise), triggering automated workflows or callbacks (unauthorized action), causing denial-of-service by flooding the system with spurious events, or, in a worst-case scenario, influencing downstream business logic that relies on voice-call metadata (e.g., CRM updates, analytics, billing systems).

No public PoC is available; the attack chain is inferred from the vulnerability class and the disclosed header-based mechanism.

Impact Assessment

Business Impact: The vulnerability exposes OpenClaw voice-call deployments to unauthorized webhook injection, which can corrupt the integrity of call-data records and trigger unintended automation. For organizations that rely on voice-call webhooks for operational workflows — such as contact-center analytics, order verification, or customer notification systems — an attacker could inject fraudulent events causing financial loss, incorrect decision-making, or degraded customer experience.

Severity Context: The CVSS base score of 8.2 reflects the serious but not critical nature of the flaw. High confidentiality impact suggests that successful exploitation could allow the attacker to read sensitive data exposed through the webhook handling path (e.g., call transcripts, metadata, or associated API responses). The low integrity impact acknowledges that while data can be manipulated, full data corruption is not achievable through this vector alone. The availability impact is not scored in the vector (A:N indicates no direct availability loss), but event flooding could indirectly cause service degradation.

Affected Systems: All OpenClaw voice-call plugin deployments running versions before 2026.2.3 that are directly reachable from untrusted networks (i.e., internet-facing) and sit behind reverse proxies that accept client-supplied forwarded headers. Internal deployments behind properly configured proxies that overwrite forwarded headers are not directly exploitable. The OSV package data shows the vulnerability affects the root package (/) with the affected range spanning all versions up to 0→unfixed, confirming broad exposure across the product line.

Blast Radius: If the voice-call plugin shares a process or execution context with other OpenClaw components, the scope-change (S:C) in the CVSS vector suggests the compromised webhook handling could affect adjacent systems beyond the immediate plugin — potentially exposing other vaulted data or enabling lateral movement to backend services.

Detection Guidance

Sigma Rule

title: Suspicious Forwarded Headers in OpenClaw Voice-Call Webhook Requests
id: 3f6e4c2a-9d84-4f7b-8b2a-1c9e5d7a3f01
status: experimental
description: Detects HTTP requests to OpenClaw voice-call webhook endpoints containing Forwarded or X-Forwarded-* headers that appear to be client-supplied (not proxy-appended), indicating potential webhook spoofing attempts.
author: ValtersIT Research Team
date: 2026/05/15
logsource:
    category: webserver
    product: openclaw
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'webhook'
    filter_known_proxy:
        c-ip|startswith: '10.0.0.0/8'
    condition: selection and not filter_known_proxy
falsepositives:
    - Legitimate multi-hop proxy chains that legitimately pass header values
    - Misconfigured proxies that append rather than overwrite header values
level: medium
tags:
    - attack.t1190
    - cve.2026.28465
    - cwe.287

YARA Rule

rule Detect_OpenClaw_VoiceCall_Webhook_Spoofing
{
    meta:
        author = "ValtersIT Research Team"
        date = "2026-05-15"
        description = "Detects suspicious Forwarded/X-Forwarded-* header patterns in web traffic indicative of CVE-2026-28465 exploitation attempts"
        cve = "CVE-2026-28465"
        score = 60
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-28465"
    strings:
        $h1 = /(?:Forwarded|X-Forwarded-For|X-Forwarded-Host|X-Forwarded-Proto)\s*:\s*[^\r\n]+/ nocase
        $h2 = "X-Forwarded-For: 127.0.0.1" nocase
        $h3 = "Forwarded: for=127.0.0.1" nocase
        $s1 = "voice-call" nocase
        $s2 = "webhook" nocase
    condition:
        all of them and filesize < 10MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-28465 - OpenClaw Voice-Call Webhook Spoofing Attempt"; flow:established,to_server; content:"POST"; http_method; content:"webhook"; http_uri; pcre:"/^(?:Forwarded|X-Forwarded-For|X-Forwarded-Host|X-Forwarded-Proto)\s*:/Hi"; http_header; reference:cve,2026-28465; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-28465; classtype:attempted-admin; sid:1700021; rev:1;)

Elastic Detection

sequence by host.id, destination.ip with maxspan=5m
  [ network where event.category == "network" and network.protocol == "http"
    and destination.port == 80 or destination.port == 443 ]
  [ http where event.category == "web" and http.request.method == "POST"
    and url.path contains "webhook"
    and http.request.headers contains "Forwarded"
    or http.request.headers contains "X-Forwarded-"
    and not source.ip == "10.0.0.0/8" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND uri_path LIKE "%webhook%"
| rex field=headers "^X-Forwarded-For:\s+(?<xff>[^\r\n]+)"
| rex field=headers "^Forwarded:\s+(?<fwd>[^\r\n]+)"
| where (isnotnull(xff) OR isnotnull(fwd))
| eval spoofing_attempt = case(
      match(xff, "^127\."), 1,
      match(xff, "^10\."), 1,
      match(fwd, "for=127\."), 1,
      match(fwd, "for=10\."), 1,
      1=1, 0)
| where spoofing_attempt = 1
| table _time, src_ip, dest_ip, uri_path, xff, fwd
| sort -_time

Wazuh OSSEC Rule

<group name="openclaw,">
  <rule id="100201" level="12">
    <decoded_as>json</decoded_as>
    <field name="method">POST</field>
    <field name="url">webhook</field>
    <regex>Forwarded\s*:</regex>
    <regex>X-Forwarded-</regex>
    <description>OpenClaw voice-call webhook request with suspicious forwarded headers detected (CVE-2026-28465)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — A single source (OSV) claims a patch exists in version 2026.2.3, but this has not been independently confirmed. Exercise caution and validate the fix in your environment.

Immediate Mitigations (before patching):

1. Configure the reverse proxy (Nginx, Apache, HAProxy, or cloud load balancer) to overwrite all incoming Forwarded and X-Forwarded-* headers with values derived from the actual TCP connection. Ensure proxy configurations do not accept client-supplied values (e.g., set proxy_set_header X-Forwarded-For $remote_addr in Nginx; ensure nginx trusted_proxies directives do not include the internet).
2. If the application supports it, restrict webhook endpoints to only accept requests from known legitimate sender IP ranges at the firewall or WAF layer (allow-listing) — do not rely on application-level checks.
3. Place a Web Application Firewall (WAF) in front of OpenClaw and add rules to strip or rewrite forwarded headers from all inbound external traffic.
4. Temporarily disable webhook processing or switch to an alternative authentication mechanism (e.g., HMAC signature verification) if such an option is available in the plugin configuration.

Patch/Upgrade Steps:

1. Confirm the patch availability by checking official OpenClaw release notes or contacting vendor support directly — do not assume the OSV claim is authoritative.
2. Upgrade the voice-call plugin to version 2026.2.3 or later. If an independent verification of the fix is not possible, test the upgrade in a staging environment first, validating that webhook verification now correctly rejects requests with mismatched forwarded headers.
3. After upgrading, perform regression testing of legitimate webhook flows to ensure the fix did not break normal provider communication.

Long-Term Hardening:

1. Adopt defense-in-depth: Implement webhook signature verification (e.g., HMAC-SHA256 with shared secrets) regardless of source IP checks. This neutralizes header-spoofing attacks entirely.
2. Proxy security review: Audit all reverse-proxy configurations for trust proxy settings and ensure forwarded headers are only accepted from trusted upstream proxies, never from internet-facing client connections.
3. Network segmentation: Place OpenClaw voice-call services behind an internal DMZ and restrict direct internet exposure to the reverse proxy only.
4. Monitoring: Enable logging of all webhook requests, including full header dumps, and correlate with upstream proxy logs to detect header discrepancies.
5. Vendor relationship: Actively request patch confirmation from OpenClaw maintainers; monitor their security advisories for a formal CVE disclosure and advisory.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-28465 — Official CVE record with NVD description, CVSS score (8.2), and reference material updates.
2. OSV Vulnerability Database: https://osv.dev/vulnerability/CVE-2026-28465 — OSV entry providing the patch claim (version 2026.2.3) and affected package range; EPSS score 0.00374 (30.2% percentile).
3. OpenClaw Official Website: https://openclaw.example.com/security — Vendor product page and security advisory section (to be consulted for confirmed patch details and release notes).
4. CWE-287 Reference: https://cwe.mitre.org/data/definitions/287.html — MITRE CWE reference for Improper Authentication, the vulnerability class underlying this CVE.
5. EPSS Data: https://www.first.org/epss/ — FIRST's EPSS scoring reference for context on the low exploitation-probability score (0.00374 at 30.2% percentile).

Threat Actor Campaigns & Exploit-in-the-Wild Evidence: None identified. CISA KEV status is NO, indicating no confirmed exploitation in-the-wild as of the latest data. No public PoC, Nuclei template, or exploit code has been published. The EPSS score (0.00374) places this CVE in a low-percentile range for active exploitation likelihood, though this should not diminish the urgency of patching given the trivial attack mechanics.