OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, a…

Published:

28 maart 2026 om 23:00:00

Alert date:

29 maart 2026 om 14:05:43

Source:

nvd.nist.gov

Web Technologies, Security Tools

OpenClaw before version 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode. The vulnerability occurs when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can exploit this by injecting forged Feishu events and triggering downstream tool execution by reaching the webhook endpoint. This represents a significant security risk as it allows unauthorized remote code execution through webhook manipulation.

Technical details

Mitigation steps:

Affected products:

OpenClaw