EUVD-2026-17013
GHSA-vjqw-w5jr-g9w5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify webhook endpoint with verificationToken only
-
DeliveryCraft forged Feishu event JSON
-
ExploitSend to webhook without encryptKey validation
-
ExecutionBypass authentication
-
ImpactTrigger downstream tool execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Exploitation Conditions | OpenClaw versions before 2026.3.12 with Feishu webhook mode enabled using only verificationToken without encryptKey configuration. Remote unauthenticated attacker can send crafted HTTP requests to the webhook endpoint to inject forged Feishu events and execute downstream tools. |
| Impact | Real-world risk is high for organizations using Feishu webhook integrations in OpenClaw with incomplete configuration. CVSS 8.8 accurately reflects the attack profile: network-accessible (AV:N), trivial to exploit once verificationToken is known (AC:L), requires no authentication (PR:N), and delivers high integrity impact (VI:H) through downstream command injection or workflow manipulation. However, exploitation prerequisites temper immediate risk: attackers must identify OpenClaw webhook endpoints (not publicly indexed by default) and obtain or guess the verificationToken value. No confirmed active exploitation per CISA KEV data and no public exploit code exists, reducing likelihood versus theoretical impact. SSVC decision factors: exploitation not confirmed (Observed:None), likely automatable once token obtained (Automatable:Yes), technical impact allows significant control over connected systems (TechnicalImpact:Total). Priority depends on asset exposure-internet-facing instances with Feishu integration warrant immediate patching, while internal deployments have lower urgency if network segmentation limits attacker reach to webhook endpoints. |
| Exploit ScenarioDerived | An external attacker discovers an internet-facing OpenClaw instance through reconnaissance of corporate infrastructure, identifying the Feishu webhook endpoint URL pattern. Through social engineering or configuration file exposure in a public repository, the attacker obtains the verificationToken value. They craft a malicious HTTP POST request to the webhook endpoint containing a forged Feishu event payload with valid verificationToken but manipulated event data-for example, injecting commands into fields processed by downstream automation tools. OpenClaw's incomplete validation accepts the request as legitimate, triggering automated workflows that execute the attacker's payload against internal systems, potentially leading to data exfiltration, service disruption, or lateral movement depending on downstream tool permissions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 29, 2026
Authentication bypass in OpenClaw's Feishu webhook integration (pre-2026.3.12) allows unauthenticated remote attackers to inject forged events and trigger arbitrary downstream tool execution. The vulnerability occurs when administrators configure only verificationToken without encryptKey, enabling attackers to craft malicious webhook payloads that bypass validation. No public exploit identified at time of analysis, though CVSS 8.8 reflects network accessibility (AV:N), zero complexity (AC:L), and no privileges required (PR:N).
RemediationAI
Upgrade to OpenClaw version 2026.3.12 or later, which enforces mandatory encryptKey validation for Feishu webhook requests. The patched version rejects webhook events lacking cryptographic signature verification, closing the authentication bypass vector. For environments unable to immediately upgrade, implement compensating controls: configure encryptKey parameter in webhook settings to enable HMAC-based payload authentication, restrict network access to webhook endpoints using firewall rules or reverse proxy ACLs permitting only Feishu server IP ranges, and enable request logging to detect anomalous webhook traffic patterns. Verify remediation by attempting webhook delivery with valid verificationToken but invalid or missing encryptKey-the application should reject the request post-patch. Consult vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-g353-mgv3-8pcj for configuration migration guidance and backward compatibility considerations when enabling encryptKey on existing deployments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenClaw implements webhook integration with Feishu (ByteDance's enterprise collaboration platform) using two-tier security: verificationToken for basic request validation and encryptKey for cryptographic payload verification. The vulnerability stems from CWE-347 (Improper Verification of Cryptographic Signature), where the application accepts events authenticated only by verificationToken-a shared secret transmitted in cleartext-without enforcing encryptKey-based HMAC or digital signature verification. When encryptKey is omitted from configuration, attackers can forge valid-appearing webhook requests by simply including the verificationToken, which may be leaked through network traffic inspection, configuration exposures, or social engineering. The affected CPE (cpe:2.3:a:openclaw:openclaw) indicates this is a product-wide architecture flaw rather than version-specific regression.
Know when Openclaw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forged Feishu events and trigger downstream tool execution by reaching the webhook endpoint.
Blast Radius
ecosystem impact- 1 npm packages depend on openclaw (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.3.12.
Executive ViewAI
OpenClaw's Feistel webhook integration contains a critical authentication bypass (CVE-2026-32974) that allows unauthenticated attackers to inject forged events and trigger arbitrary downstream tool execution when administrators configure incomplete verification settings. Organizations using OpenClaw with webhook integrations are at immediate risk of unauthorized command execution and data manipulation without requiring valid credentials or network access restrictions.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Require both verificationToken AND encryptKey in all webhook configurations immediately; (2) Restrict webhook endpoint access via firewall/WAF to whitelisted IP addresses of trusted integrations; (3) Enable audit logging for all webhook events and implement alert rules for failed verification attempts; (4) Disable unused webhook integrations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in OpenClaw Authentication and Token Bypass
View all 4Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
Authentication bypass in OpenClaw before 2026.5.3 allows remote attackers with low privileges to receive agent responses
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'a
Unauthenticated access to the noVNC observer interface in OpenClaw's Docker sandbox browser allows anyone who can reach
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
Exploit-DB