{"action":"Upgrade openclaw to 2026.3.31 or later.","affected":[{"fixed":"2026.3.31","introduced":"2026.2.19"}],"component":"openclaw","cve_ids":["CVE-2026-41362"],"ecosystem":"npm","epss":0.00274,"exploited":false,"fixed_versions":["2026.3.31"],"ghsa_id":"GHSA-fqrj-m88p-qf3v","id":"tcs_01M5KFP2ZBANFHTH20385DDY7T","modified_at":"2026-07-08T08:12:54.563191149Z","published_at":"2026-04-07T18:14:50Z","references":["https://osv.dev/vulnerability/GHSA-fqrj-m88p-qf3v","https://github.com/openclaw/openclaw/security/advisories/GHSA-fqrj-m88p-qf3v","https://github.com/openclaw/openclaw/commit/4d038bb242c11f39e45f6a4bde400e5fd42e4ebf","https://github.com/openclaw/openclaw/commit/7cea7c29705b188b464cc9cdc107c275b94b2a72","https://github.com/openclaw/openclaw"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-fqrj-m88p-qf3v","url":"https://osv.dev/vulnerability/GHSA-fqrj-m88p-qf3v"}],"summary":"OpenClaw: Zalo replay dedupe cache could suppress events across authenticated webhook targets"}