BREW-OPENCLAW-CLI-CVE-20… (GHSA-5MX2-2MGW-X8RM)

Vulnerability from osv_homebrew – Published: 2026-08-13 17:21 – Updated: 2026-09-25 08:57 – Source website
VLAI
Summary
OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)
Details

Summary

BlueBubbles webhook auth in the optional beta iMessage plugin allowed a passwordless fallback path. In some reverse-proxy/local routing setups, this could allow unauthenticated webhook events.

Affected Component and Scope

  • Component: extensions/bluebubbles webhook handler
  • Scope: only deployments using the optional BlueBubbles plugin where webhook password auth was not configured for incoming webhook events

Affected Packages / Versions

  • Package: openclaw/openclaw (npm)
  • Latest published npm version at triage time (2026-02-21): 2026.2.19-2
  • Affected structured range: <=2026.2.19-2
  • Fixed on main; planned patched release: 2026.2.21 (>=2026.2.21)

Details

The vulnerable implementation had multiple auth branches, including a passwordless fallback with loopback/proxy heuristics.

The fix now uses one authentication codepath: - inbound webhook token/guid must match channels.bluebubbles.password - webhook target matching is consolidated to shared plugin-sdk logic - BlueBubbles config validation now requires password when serverUrl is set

Impact

BlueBubbles is an optional beta iMessage plugin, and onboarding/channel-add flows already require a password. Practical exposure is mainly custom/manual configurations that omitted webhook password authentication.

Remediation

  • Upgrade to a release that includes this patch (>=2026.2.21, planned).
  • Ensure BlueBubbles webhook delivery includes a matching password (?password=<password> or x-password).

Fix Commit(s)

  • 6b2f2811dc623e5faaf2f76afaa9279637174590
  • 283029bdea23164ab7482b320cb420d1b90df806

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.21) so once npm release is out, advisory publish can proceed without additional ticket edits.

OpenClaw thanks @zpbrent for reporting.

Severity
4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
6.3 (Medium)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "2026.2.21"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "openclaw-cli",
        "purl": "pkg:brew/openclaw-cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "npm",
        "key": "pkg:npm/openclaw@2026.9.6",
        "name": "openclaw",
        "strategy": "registry",
        "subject_version": "2026.9.6"
      }
    ]
  },
  "details": "### Summary\nBlueBubbles webhook auth in the optional beta iMessage plugin allowed a passwordless fallback path. In some reverse-proxy/local routing setups, this could allow unauthenticated webhook events.\n\n### Affected Component and Scope\n- Component: `extensions/bluebubbles` webhook handler\n- Scope: only deployments using the optional BlueBubbles plugin where webhook password auth was not configured for incoming webhook events\n\n### Affected Packages / Versions\n- Package: `openclaw/openclaw` (npm)\n- Latest published npm version at triage time (2026-02-21): `2026.2.19-2`\n- Affected structured range: `\u003c=2026.2.19-2`\n- Fixed on `main`; planned patched release: `2026.2.21` (`\u003e=2026.2.21`)\n\n### Details\nThe vulnerable implementation had multiple auth branches, including a passwordless fallback with loopback/proxy heuristics.\n\nThe fix now uses one authentication codepath:\n- inbound webhook token/guid must match `channels.bluebubbles.password`\n- webhook target matching is consolidated to shared plugin-sdk logic\n- BlueBubbles config validation now requires `password` when `serverUrl` is set\n\n### Impact\nBlueBubbles is an optional beta iMessage plugin, and onboarding/channel-add flows already require a password. Practical exposure is mainly custom/manual configurations that omitted webhook password authentication.\n\n### Remediation\n- Upgrade to a release that includes this patch (`\u003e=2026.2.21`, planned).\n- Ensure BlueBubbles webhook delivery includes a matching password (`?password=\u003cpassword\u003e` or `x-password`).\n\n### Fix Commit(s)\n- `6b2f2811dc623e5faaf2f76afaa9279637174590`\n- `283029bdea23164ab7482b320cb420d1b90df806`\n\n### Release Process Note\n`patched_versions` is pre-set to the planned next release (`2026.2.21`) so once npm release is out, advisory publish can proceed without additional ticket edits.\n\nOpenClaw thanks @zpbrent for reporting.",
  "id": "BREW-openclaw-cli-CVE-2026-32896",
  "modified": "2026-09-25T08:57:16Z",
  "published": "2026-08-13T17:21:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-5mx2-2mgw-x8rm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32896"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/283029bdea23164ab7482b320cb420d1b90df806"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/6b2f2811dc623e5faaf2f76afaa9279637174590"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openclaw-unauthenticated-webhook-access-via-passwordless-fallback-in-bluebubbles-plugin"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)",
  "upstream": [
    "GHSA-5mx2-2mgw-x8rm",
    "CVE-2026-32896"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.