Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-32896
4.8 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): HIGH
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): LOW
- Integrity impact (I): LOW
- Availability impact (A): NONE
OpenClaw < 2026.2.21 - Unauthenticated Webhook Access via Passwordless Fallback in BlueBubbles Plugin
OpenClaw versions prior to 2026.2.21 BlueBubbles webhook handler contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations. Attackers can bypass webhook authentication by exploiting the loopback/proxy heuristics to send unauthenticated webhook events to the BlueBubbles plugin.
References
-
GitHub Security Advisory (GHSA-5mx2-2mgw-x8rm) third-party-advisory
-
Patch Commit #1 patch
-
Patch Commit #2 patch
Affected products
OpenClaw
- <2026.2.21
- ==2026.2.21
Package maintainers
-
@chrisportela Chris Portela <chris@chrisportela.com>