CVE-2026-8305

Katalog CVE

CVSS 9.8 · Critical EPSS 1,1%

Kerentanan Improper Authentication pada openclaw. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability was detected in OpenClaw up to 2026.1.24. The impacted element is the function handleBlueBubblesWebhookRequest of the file extensions/bluebubbles/src/monitor.ts of the component bluebubbles Webhook. Performing a manipulation results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 2026.2.12 is sufficient to resolve this issue. The patch is named a6653be0265f1f02b9de46c06f52ea7c81a836e6. The affected component should be upgraded.

Rincian

Terbit di NVD

11 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Dave-gilmore-aus/security-advisories/blob/main/ClawdBot(aka%20OpenClaw)-Auth-Bypass-SSRF exploit · mitigasi · advisory vendor
• https://github.com/openclaw/openclaw/commit/a6653be0265f1f02b9de46c06f52ea7c81a836e6 patch
• https://github.com/openclaw/openclaw/pull/13787 issue tracking · patch
• https://github.com/openclaw/openclaw/issues/13786 exploit · issue tracking · mitigasi
• https://vuldb.com/submit/809371 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/362590 advisory pihak ketiga · vdb entry
• https://github.com/openclaw/openclaw/ product
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.12 release notes
• https://vuldb.com/vuln/362590/cti permissions required · vdb entry