CVE-2026-32896Withdrawn

OpenClaw < 2026.2.21 - Unauthenticated Webhook Access via Passwordless Fallback in BlueBubbles Plugin

CVSS 4.0 6.3 MEDIUMCVSS 3.1 4.8 MEDIUMEUVD CVSS 4.0 6.3 CVSS 4.0 · [email protected] · Secondary 6.3 MEDIUMCVSS 3.1 · [email protected] · Secondary 4.8 MEDIUMCVSS 3.1 · [email protected] · Primary 6.5 MEDIUMCVSS_V3 CVSS_V4 Publisher rating MODERATEFixed by openclaw 2026.2.21CVSS_V3 CVSS_V4 Publisher rating MODERATEKEV status unknown

Original advisory

cve-program · CVE-2026-32896

Published

The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations. Attackers can bypass webhook authentication by exploiting the loopback/proxy heuristics to send unauthenticated webhook events to the BlueBubbles plugin.

Read the publisher's advisory

euvd · EUVD-2026-13972

Published

Read the publisher's advisory

nvd · CVE-2026-32896

Published

Read the publisher's advisory

osv · GHSA-5mx2-2mgw-x8rm

Published

### Summary BlueBubbles webhook auth in the optional beta iMessage plugin allowed a passwordless fallback path. In some reverse-proxy/local routing setups, this could allow unauthenticated webhook events. ### Affected Component and Scope - Component: `extensions/bluebubbles` webhook handler - Scope: only deployments using the optional BlueBubbles plugin where webhook password auth was not configured for incoming webhook events ### Affected Packages / Versions - Package: `openclaw/openclaw` (npm) - Latest published npm version at triage time (2026-02-21): `2026.2.19-2` - Affected structured range: `<=2026.2.19-2` - Fixed on `main`; planned patched release: `2026.2.21` (`>=2026.2.21`) ### Details The vulnerable implementation had multiple auth branches, including a passwordless fallback with loopback/proxy heuristics. The fix now uses one authentication codepath: - inbound webhook token/guid must match `channels.bluebubbles.password` - webhook target matching is consolidated to shared plugin-sdk logic - BlueBubbles config validation now requires `password` when `serverUrl` is set ### Impact BlueBubbles is an optional beta iMessage plugin, and onboarding/channel-add flows already require a password. Practical exposure is mainly custom/manual configurations that omitted webhook password authentication. ### Remediation - Upgrade to a release that includes this patch (`>=2026.2.21`, planned). - Ensure BlueBubbles webhook delivery includes a matching password (`?password=<password>` or `x-password`). ### Fix Commit(s) - `6b2f2811dc623e5faaf2f76afaa9279637174590` - `283029bdea23164ab7482b320cb420d1b90df806` ### Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.21`) so once npm release is out, advisory publish can proceed without additional ticket edits. OpenClaw thanks @zpbrent for reporting.

Read the publisher's advisory

osv · GHSA-vh4c-j2xv-9pv9

Withdrawn

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5mx2-2mgw-x8rm. This link is maintained to preserve external references. ## Original Description OpenClaw versions prior to 2026.2.21 BlueBubbles webhook handler contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations. Attackers can bypass webhook authentication by exploiting the loopback/proxy heuristics to send unauthenticated webhook events to the BlueBubbles plugin.

Read the publisher's advisory

Affected versions, risk and source history

Exploitation and risk

Source status

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

Which CVEs have scores here?

This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

Risk history

Compare earlier KEV listings and daily EPSS scores. Advisory wording and affected versions have a separate history.

When does an EPSS score appear as a change?

A prediction change is reported when EPSS rises from below 10% to 10% or higher. Other daily score changes remain in this history.

Advisory history

12 saved versions

See how the publisher's advisory changed over time. Each link opens the version saved at that time. The publisher's update date can differ from the date shown here.

How advisory history works

Each link identifies one complete publisher record. History can include advisories that previously shared an identifier; an identifier removed by a publisher no longer establishes a current relationship. A historical link shows only that record and earlier saved versions. Failed checks and unchanged reads do not create new versions.

12 Nov 2026 05:03:23 UTC