{"action":"Upgrade openclaw to 2026.3.31 or later.","affected":[{"fixed":"2026.3.31","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-41402"],"ecosystem":"npm","epss":0.00266,"exploited":false,"fixed_versions":["2026.3.31"],"ghsa_id":"GHSA-hhq4-97c2-p447","id":"tcs_01M5KFV8Y4AYJVTGDZ21HRN64N","modified_at":"2026-05-06T02:51:12.109158Z","published_at":"2026-04-02T20:59:11Z","references":["https://osv.dev/vulnerability/GHSA-hhq4-97c2-p447","https://github.com/openclaw/openclaw/security/advisories/GHSA-hhq4-97c2-p447","https://nvd.nist.gov/vuln/detail/CVE-2026-41402","https://github.com/openclaw/openclaw/commit/4d038bb242c11f39e45f6a4bde400e5fd42e4ebf","https://github.com/openclaw/openclaw","https://github.com/openclaw/openclaw/releases/tag/v2026.3.31","https://www.vulncheck.com/advisories/openclaw-webhook-replay-cache-cross-target-messageid-scope-bypass"],"severity":{"label":"medium","score":4.2},"sources":[{"source":"osv","source_id":"GHSA-hhq4-97c2-p447","url":"https://osv.dev/vulnerability/GHSA-hhq4-97c2-p447"}],"summary":"OpenClaw: Zalo webhook replay cache cross-target messageId scope bypass"}