{"action":"Upgrade openclaw to 2026.2.26 or later.","affected":[{"fixed":"2026.2.26","introduced":"0"}],"component":"openclaw","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["2026.2.26"],"ghsa_id":"GHSA-gcj7-r3hg-m7w6","id":"tcs_01M5KFRBHCEDAH97K19X3HWD98","modified_at":"2026-03-04T15:13:36.464272Z","published_at":"2026-03-03T22:25:37Z","references":["https://osv.dev/vulnerability/GHSA-gcj7-r3hg-m7w6","https://github.com/openclaw/openclaw/security/advisories/GHSA-gcj7-r3hg-m7w6","https://github.com/openclaw/openclaw/commit/1aadf26f9acc399affabd859937a09468a9c5cb4","https://github.com/openclaw/openclaw"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-gcj7-r3hg-m7w6","url":"https://osv.dev/vulnerability/GHSA-gcj7-r3hg-m7w6"}],"summary":"OpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity"}