PT-2026-26745
CVE-2026-32896
·
Publicado
2026-03-03
·
Atualizado
2026-09-17
Descrição por
CVSS 3.1
6.5
MédiaMétricasAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.2.21
Description
The BlueBubbles webhook handler in OpenClaw contains a passwordless fallback authentication path. This allows unauthenticated webhook events to occur in specific reverse-proxy or local routing setups. Attackers can bypass webhook authentication by exploiting loopback/proxy heuristics to send unauthenticated webhook events to the BlueBubbles plugin.
Recommendations
Update OpenClaw to version 2026.2.21 or later.
Explorabilidade
Exploit
Correção
Impactos
Pesquisadores
Fornecedores
Produtos afetados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾