https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 09:10:50 +0000 https://vulnerability.circl.lu/vuln/cve-2026-32896 <p><strong>Affected:</strong> OpenClaw</p> <p>The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations. Attackers can bypass webhook authentication by exploiting the loopback/proxy heuristics to send unauthenticated webhook events to the BlueBubbles plugin.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations. Attackers can bypass webhook authentication by exploiting the loopback/proxy heuristics to send unauthenticated webhook events to the BlueBubbles plugin.</p> https://vulnerability.circl.lu/vuln/cve-2026-32896 https://vulnerability.circl.lu/vuln/ghsa-5mx2-2mgw-x8rm <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary BlueBubbles webhook auth in the optional beta iMessage plugin allowed a passwordless fallback path. In some reverse-proxy/local routing setups, this could allow unauthenticated webhook events.</p> <p>### Affected Component and Scope - Component: `extensions/bluebubbles` webhook handler - Scope: only deployments using the optional BlueBubbles plugin where webhook password auth was not configured for incoming webhook events</p> <p>### Affected Packages / Versions - Package: `openclaw/openclaw` (npm) - Latest published npm version at triage time (2026-02-21): `2026.2.19-2` - Affected structured range: `&lt;=2026.2.19-2` - Fixed on `main`; planned patched release: `2026.2.21` (`&gt;=2026.2.21`)</p> <p>### Details The vulnerable implementation had multiple auth branches, including a passwordless fallback with loopback/proxy heuristics.</p> <p>The fix now uses one authentication codepath: - inbound webhook token/guid must match `channels.bluebubbles.password` - webhook target matching is consolidated to shared plugin-sdk logic - BlueBubbles config validation now requires `password` when `serverUrl` is set</p> <p>### Impact BlueBubbles is an optional beta iMessage plugin, and onboarding/channel-add flows already require a password. Practical exposure is mainly custom/manual configurations that omitted webhook password authentication.</p> <p>### Remediation - Upgrade to a release that includes this patch (`&gt;=2026.2.21`, planned). - Ensure BlueBubbles webhook delivery includes a matching password (`?password=&lt;pas…</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary BlueBubbles webhook auth in the optional beta iMessage plugin allowed a passwordless fallback path. In some reverse-proxy/local routing setups, this could allow unauthenticated webhook events.</p> <p>### Affected Component and Scope - Component: `extensions/bluebubbles` webhook handler - Scope: only deployments using the optional BlueBubbles plugin where webhook password auth was not configured for incoming webhook events</p> <p>### Affected Packages / Versions - Package: `openclaw/openclaw` (npm) - Latest published npm version at triage time (2026-02-21): `2026.2.19-2` - Affected structured range: `&lt;=2026.2.19-2` - Fixed on `main`; planned patched release: `2026.2.21` (`&gt;=2026.2.21`)</p> <p>### Details The vulnerable implementation had multiple auth branches, including a passwordless fallback with loopback/proxy heuristics.</p> <p>The fix now uses one authentication codepath: - inbound webhook token/guid must match `channels.bluebubbles.password` - webhook target matching is consolidated to shared plugin-sdk logic - BlueBubbles config validation now requires `password` when `serverUrl` is set</p> <p>### Impact BlueBubbles is an optional beta iMessage plugin, and onboarding/channel-add flows already require a password. Practical exposure is mainly custom/manual configurations that omitted webhook password authentication.</p> <p>### Remediation - Upgrade to a release that includes this patch (`&gt;=2026.2.21`, planned). - Ensure BlueBubbles webhook delivery includes a matching password (`?password=&lt;pas…</p> https://vulnerability.circl.lu/vuln/ghsa-5mx2-2mgw-x8rm