CVE-2026-32896

low-risk
Published 2026-03-21

OpenClaw versions prior to 2026.2.21 BlueBubbles webhook handler contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations. Attackers can bypass webhook authentication by exploiting the loopback/proxy heuristics to send unauthenticated webhook events to the BlueBubbles plugin.

Do I need to act?

-
0.08% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.8/10 Medium
NETWORK / HIGH complexity

Affected Products (1)

Affected Vendors

Openclaw

References (4)

Patch https://github.com/openclaw/openclaw/commit/283029bdea23164ab7482b320cb420d1b90d...
Patch https://github.com/openclaw/openclaw/commit/6b2f2811dc623e5faaf2f76afaa927963717...
Vendor Advisory https://github.com/openclaw/openclaw/security/advisories/GHSA-5mx2-2mgw-x8rm
Third Party Advisory https://www.vulncheck.com/advisories/openclaw-unauthenticated-webhook-access-via...
20
/ 100
low-risk
Severity 15/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal