PT-2026-35637 · Npm · Openclaw

Published 2026-04-17 · Updated 2026-04-17

OSV

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

Feishu webhook mode accepted missing encryptKey configuration as valid and blank card-action callback tokens as usable lifecycle tokens. Together, those fail-open paths could allow unauthenticated webhook or card-action traffic to reach command dispatch in affected deployments.

Impact

A deployment using Feishu webhook mode without a configured encryptKey, or handling malformed card-action callbacks with blank callback tokens, could fail open instead of rejecting the request. Severity remains critical because affected webhook deployments expose a network-triggered path into OpenClaw command handling without the expected Feishu signature or replay protection.

Affected versions

• Affected: < 2026.4.15
• Patched: 2026.4.15

Fix

OpenClaw 2026.4.15 makes Feishu webhook and card-action validation fail closed. Webhook mode now refuses to start without an encryptKey, missing signing configuration returns invalid instead of valid, invalid signatures return 401, and blank card-action callback tokens are rejected before dispatch.

Verified in v2026.4.15:

• extensions/feishu/src/monitor.transport.ts returns invalid when encryptKey is missing, refuses webhook mode without encryptKey, and rejects invalid signatures before JSON handling.
• extensions/feishu/src/card-action.ts rejects blank callback tokens in the card-action lifecycle guard.
• extensions/feishu/src/monitor.webhook-security.test.ts covers missing-encryptKey startup and transport rejection.
• extensions/feishu/src/monitor.card-action.lifecycle.test.ts covers malformed blank-token card actions being dropped before handler dispatch.

Fix commit included in v2026.4.15 and absent from v2026.4.14:

• c8003f1b33ed2924be5f62131bd28742c5a41aae via PR #66707

Thanks to @dhyabi2 for reporting this issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-294

CWE-1188

Related Identifiers

GHSA-XH72-V6V9-MWHC

Affected Products

Openclaw

References · 7

• https://osv.dev/vulnerability/GHSA-xh72-v6v9-mwhc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44109 · Security Note
• https://github.com/openclaw/openclaw/security/advisories/GHSA-xh72-v6v9-mwhc · Note
• https://github.com/openclaw/openclaw/commit/c8003f1b33ed2924be5f62131bd28742c5a41aae · Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/pull/66707 · Note
• https://vulncheck.com/advisories/openclaw-authentication-bypass-in-feishu-webhook-and-card-action-validation · Note