CVE-2026-35618: OpenClaw: Plivo V2 verified replay identity drifts on query-only variants
(updated )
Before v2026.3.23, the Plivo V2 verification path treated query-only variants of the same signed request as fresh verified work. Plivo V2 signatures authenticate baseUrl + nonce, but the replay key was derived from the full verification URL including the query string, so unsigned query-only changes minted a new verifiedRequestKey.
References
- github.com/advisories/GHSA-cg6c-q2hx-69h7
- github.com/openclaw/openclaw
- github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87
- github.com/openclaw/openclaw/commit/b0ce53a79cf63834660270513e26d921899b4e5b
- github.com/openclaw/openclaw/security/advisories/GHSA-cg6c-q2hx-69h7
- nvd.nist.gov/vuln/detail/CVE-2026-35618
- www.vulncheck.com/advisories/openclaw-replay-identity-drift-via-query-only-variants-in-plivo-v2-verification
Code Behaviors & Features
Detect and mitigate CVE-2026-35618 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →