Vulnerability Details CVE-2026-28469
OpenClaw versions prior to 2026.2.14 contain a webhook routing vulnerability in the Google Chat monitor component that allows cross-account policy context misrouting when multiple webhook targets share the same HTTP path. Attackers can exploit first-match request verification semantics to process inbound webhook events under incorrect account contexts, bypassing intended allowlists and session policies.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 7.0%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2026-28469
-
cpe:2.3:a:openclaw:openclaw:0.1.0
-
cpe:2.3:a:openclaw:openclaw:0.1.1
-
cpe:2.3:a:openclaw:openclaw:0.1.2
-
cpe:2.3:a:openclaw:openclaw:0.1.3
-
cpe:2.3:a:openclaw:openclaw:1.0.4
-
cpe:2.3:a:openclaw:openclaw:1.1.0
-
cpe:2.3:a:openclaw:openclaw:1.2.0
-
cpe:2.3:a:openclaw:openclaw:1.2.1
-
cpe:2.3:a:openclaw:openclaw:1.2.2
-
cpe:2.3:a:openclaw:openclaw:1.3.0
-
cpe:2.3:a:openclaw:openclaw:2.0.0
-
cpe:2.3:a:openclaw:openclaw:2026.1.10
-
cpe:2.3:a:openclaw:openclaw:2026.1.11
-
cpe:2.3:a:openclaw:openclaw:2026.1.11-1
-
cpe:2.3:a:openclaw:openclaw:2026.1.11-2
-
cpe:2.3:a:openclaw:openclaw:2026.1.11-3
-
cpe:2.3:a:openclaw:openclaw:2026.1.12
-
cpe:2.3:a:openclaw:openclaw:2026.1.12-2
-
cpe:2.3:a:openclaw:openclaw:2026.1.13
-
cpe:2.3:a:openclaw:openclaw:2026.1.14-1
-
cpe:2.3:a:openclaw:openclaw:2026.1.15
-
cpe:2.3:a:openclaw:openclaw:2026.1.16-2
-
cpe:2.3:a:openclaw:openclaw:2026.1.20
-
cpe:2.3:a:openclaw:openclaw:2026.1.21
-
cpe:2.3:a:openclaw:openclaw:2026.1.22
-
cpe:2.3:a:openclaw:openclaw:2026.1.23
-
cpe:2.3:a:openclaw:openclaw:2026.1.24
-
cpe:2.3:a:openclaw:openclaw:2026.1.24-1
-
cpe:2.3:a:openclaw:openclaw:2026.1.29
-
cpe:2.3:a:openclaw:openclaw:2026.1.30
-
cpe:2.3:a:openclaw:openclaw:2026.1.5
-
cpe:2.3:a:openclaw:openclaw:2026.1.5-1
-
cpe:2.3:a:openclaw:openclaw:2026.1.5-2
-
cpe:2.3:a:openclaw:openclaw:2026.1.5-3
-
cpe:2.3:a:openclaw:openclaw:2026.1.8
-
cpe:2.3:a:openclaw:openclaw:2026.1.9
-
cpe:2.3:a:openclaw:openclaw:2026.2.1
-
cpe:2.3:a:openclaw:openclaw:2026.2.12
-
cpe:2.3:a:openclaw:openclaw:2026.2.13
-
cpe:2.3:a:openclaw:openclaw:2026.2.2
-
cpe:2.3:a:openclaw:openclaw:2026.2.3
-
cpe:2.3:a:openclaw:openclaw:2026.2.6
-
cpe:2.3:a:openclaw:openclaw:2026.2.6-1
-
cpe:2.3:a:openclaw:openclaw:2026.2.6-2
-
cpe:2.3:a:openclaw:openclaw:2026.2.6-3
-
cpe:2.3:a:openclaw:openclaw:2026.2.9