https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-02T09:10:53.391037+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-32896 CVE-2026-32896 — OpenClaw < 2026.2.21 - Unauthenticated Webhook Access via Passwordless Fallback in BlueBubbles Plugin 2026-10-02T09:10:54.014565+00:00

Affected: OpenClaw

The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations. Attackers can bypass webhook authentication by exploiting the loopback/proxy heuristics to send unauthenticated webhook events to the BlueBubbles plugin.

 https://vulnerability.circl.lu/vuln/ghsa-5mx2-2mgw-x8rm GHSA-5mx2-2mgw-x8rm — OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback) 2026-10-02T09:10:54.014647+00:00

Affected: npm: openclaw

### Summary BlueBubbles webhook auth in the optional beta iMessage plugin allowed a passwordless fallback path. In some reverse-proxy/local routing setups, this could allow unauthenticated webhook events.

### Affected Component and Scope - Component: `extensions/bluebubbles` webhook handler - Scope: only deployments using the optional BlueBubbles plugin where webhook password auth was not configured for incoming webhook events

### Affected Packages / Versions - Package: `openclaw/openclaw` (npm) - Latest published npm version at triage time (2026-02-21): `2026.2.19-2` - Affected structured range: `<=2026.2.19-2` - Fixed on `main`; planned patched release: `2026.2.21` (`>=2026.2.21`)

### Details The vulnerable implementation had multiple auth branches, including a passwordless fallback with loopback/proxy heuristics.

The fix now uses one authentication codepath: - inbound webhook token/guid must match `channels.bluebubbles.password` - webhook target matching is consolidated to shared plugin-sdk logic - BlueBubbles config validation now requires `password` when `serverUrl` is set

### Impact BlueBubbles is an optional beta iMessage plugin, and onboarding/channel-add flows already require a password. Practical exposure is mainly custom/manual configurations that omitted webhook password authentication.

### Remediation - Upgrade to a release that includes this patch (`>=2026.2.21`, planned). - Ensure BlueBubbles webhook delivery includes a matching password (`?password=<pas…