CVE-2026-32896

Katalog CVE

CVSS 6.5 · Medium EPSS 0,43%

Kerentanan Missing Authentication for Critical Function pada openclaw. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations. Attackers can bypass webhook authentication by exploiting the loopback/proxy heuristics to send unauthenticated webhook events to the BlueBubbles plugin.

Rincian

Terbit di NVD

21 Maret 2026

Terakhir diubah

17 September 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openclaw/openclaw/security/advisories/GHSA-5mx2-2mgw-x8rm advisory vendor
• https://github.com/openclaw/openclaw/commit/283029bdea23164ab7482b320cb420d1b90df806 patch
• https://github.com/openclaw/openclaw/commit/6b2f2811dc623e5faaf2f76afaa9279637174590 patch
• https://www.vulncheck.com/advisories/openclaw-unauthenticated-webhook-access-via-passwordless-fallback-in-blue... advisory pihak ketiga