PT-2026-26745 · WordPress+1 · Bluebubbles+1

Peng Zhou · Published 2026-03-03 · Updated 2026-03-21 · CVE-2026-32896

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.21

Description The BlueBubbles webhook handler in OpenClaw contains a passwordless fallback authentication path. This allows unauthenticated webhook events to occur in specific reverse-proxy or local routing setups. Attackers can bypass webhook authentication by exploiting loopback/proxy heuristics to send unauthenticated webhook events to the BlueBubbles plugin.

Recommendations Update OpenClaw to version 2026.2.21 or later.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-32896

GHSA-5MX2-2MGW-X8RM

GHSA-VH4C-J2XV-9PV9

Affected Products

Bluebubbles

Openclaw

References · 11

• https://github.com/openclaw/openclaw/commit/283029bdea23164ab7482b320cb420d1b90df806 · Patch
• https://github.com/openclaw/openclaw/commit/6b2f2811dc623e5faaf2f76afaa9279637174590 · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-5mx2-2mgw-x8rm · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vh4c-j2xv-9pv9 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5mx2-2mgw-x8rm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32896 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32896 · Vendor Advisory
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/infoflowcloud/status/2035239041692508374 · Twitter Post
• https://vulncheck.com/advisories/openclaw-unauthenticated-webhook-access-via-passwordless-fallback-in-bluebubbles-plugin · Note
• https://twitter.com/CVEnew/status/2035237324871868629 · Twitter Post