CVE-2026-32896

MEDIUM EPSS 16.1%
Published Mar 21, 20263mo ago · Modified Jun 17, 20262w ago
6.3 CVSS 4.0
Medium
Find Similar
Published Mar 21, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations. Attackers can bypass webhook authentication by exploiting the loopback/proxy heuristics to send unauthenticated webhook events to the BlueBubbles plugin.

CVSS Details

Base Score
6.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
16.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-306 Missing Authentication for Critical Function Authentication

Affected Products 1

VendorProductVersionRange
openclawopenclaw* <2026.2.21

References 4

  • github.com https://github.com/openclaw/openclaw/commit/283029bdea23164ab7482b320cb420d1b90df806
    Patch
  • github.com https://github.com/openclaw/openclaw/commit/6b2f2811dc623e5faaf2f76afaa9279637174590
    Patch
  • github.com https://github.com/openclaw/openclaw/security/advisories/GHSA-5mx2-2mgw-x8rm
    Vendor Advisory
  • vulncheck.com https://www.vulncheck.com/advisories/openclaw-unauthenticated-webhook-access-via-passwordless-fallback-in-bluebubbles-plugin
    Third Party Advisory

Remediation

  • github.com https://github.com/openclaw/openclaw/commit/283029bdea23164ab7482b320cb420d1b90df806
    Patch
  • github.com https://github.com/openclaw/openclaw/commit/6b2f2811dc623e5faaf2f76afaa9279637174590
    Patch