要点
- CVE-2026-41337 是影响 openclaw (openclaw), openclaw 的中危 (CVSS 5.3)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.23%，高于 13.8% 的漏洞。
- 修复：升级到 2026.3.31 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| openclaw | < 2026.3.31
| 2026.3.31
|
| openclaw npm | < 2026.3.31
| 2026.3.31
|
Description
Summary
Voice-call Plivo replay mutates in-process callback origin before replay rejection
Current Maintainer Triage
- Status: narrow
- Normalized severity: low
- Assessment: v2026.3.28 can still mutate Plivo callback origin before replay rejection, but this needs a captured valid callback for a live call so medium is overstated.
Affected Packages / Versions
- Package:
openclaw (npm)
- Latest published npm version:
2026.3.31
- Vulnerable version range:
<=2026.3.28
- Patched versions:
>= 2026.3.31
- First stable tag containing the fix:
v2026.3.31
Fix Commit(s)
efe9183f9d2fd5e01c8068fa01f4a07a58a63c0b — 2026-03-31T19:50:35+09:00
Release Process Note
- The fix is already present in released version
2026.3.31.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.
Thanks @zsxsoft for reporting.
NVD description
OpenClaw before 2026.3.31 contains a callback origin mutation vulnerability in Plivo voice-call replay that allows attackers to mutate in-process callback origin before replay rejection. Attackers with captured valid callbacks for live calls can exploit this to manipulate callback origins during the replay process.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free