PT-2026-23566 · Nginx+5 · Nginx+6

Petr Simecek

·

Published

2026-02-12

·

Updated

2026-03-11

·

CVE-2026-29613

CVSS v4.0

8.2

High

VectorAV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.12
Description The BlueBubbles webhook handler in OpenClaw authenticates requests based solely on loopback remoteAddress without validating forwarding headers. This allows bypass of configured webhook passwords when the gateway operates behind a reverse proxy. An unauthenticated remote attacker can inject arbitrary BlueBubbles message and reaction events by reaching the proxy endpoint. The issue occurs because the handler accepts requests as authenticated if the remoteAddress is loopback, without validating forwarding headers. This is exploitable when OpenClaw Gateway is behind a reverse proxy such as Tailscale Serve/Funnel, nginx, Cloudflare Tunnel, or ngrok. The vulnerable component is the BlueBubbles webhook handler, which accepts inbound events via an HTTP POST endpoint. The req.socket.remoteAddress is used for authentication.
Recommendations Versions prior to 2026.2.12 should be updated to version 2026.2.12 or later. Ensure a BlueBubbles webhook password is configured. Do not expose the gateway webhook endpoint publicly without authentication.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2026-06169
CVE-2026-29613
GHSA-XC7W-V5X6-CC87

Affected Products

Bluebubbles
Cloudflare Tunnel
Openclaw
Tailscale Funnel
Tailscale Serve
Nginx
Ngrok