CVE-2026-32896: Openclaw

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations. Attackers can bypass webhook authentication by exploiting the loopback/proxy heuristics to send unauthenticated webhook events to the BlueBubbles plugin.

Affected products

• Openclaw Openclaw: before 2026.2.21 (fixed in 2026.2.21)

Published 2026-03-21. Last modified 2026-09-17.