PT-2026-28455 · Openclaw · Openclaw
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.3.12
Description
OpenClaw is susceptible to an authentication bypass issue in Feishu webhook mode. This occurs when only the
verificationToken is configured, and the encryptKey is not. This allows unauthenticated attackers to inject forged Feishu events and potentially trigger the execution of downstream tools by reaching the webhook endpoint. The issue allows acceptance of forged events.Recommendations
Versions prior to 2026.3.12 should be updated to version 2026.3.12 or later.
Exploit
Correção
Improper Verification of Cryptographic Signature
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Openclaw