OpenClaw versions prior to 2026.2.21 BlueBubbles webhook handler contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations. Attackers can bypass webhook authentication by exploiting the loopback/proxy heuristics to send unauthenticated webhook events to the BlueBubbles plugin.
References
Configurations
History
23 Mar 2026, 19:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/openclaw/openclaw/commit/283029bdea23164ab7482b320cb420d1b90df806 - Patch | |
| References | () https://github.com/openclaw/openclaw/commit/6b2f2811dc623e5faaf2f76afaa9279637174590 - Patch | |
| References | () https://github.com/openclaw/openclaw/security/advisories/GHSA-5mx2-2mgw-x8rm - Vendor Advisory | |
| References | () https://www.vulncheck.com/advisories/openclaw-unauthenticated-webhook-access-via-passwordless-fallback-in-bluebubbles-plugin - Third Party Advisory | |
| CPE | cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:* | |
| First Time |
Openclaw openclaw
Openclaw |
21 Mar 2026, 01:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-21 01:17
Updated : 2026-03-23 19:45
NVD link : CVE-2026-32896
Mitre link : CVE-2026-32896
CVE.ORG link : CVE-2026-32896
JSON object : View
Products Affected
openclaw
- openclaw
CWE
CWE-306
Missing Authentication for Critical Function