PT-2026-38242 · Openclaw · Openclaw

Dhyabi2 · Published 2026-04-17 · Updated 2026-05-14 · CVE-2026-44109

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.15

Description An authentication bypass exists in the Feishu webhook and card-action validation. When the encryptKey configuration is missing or callback tokens are blank, the system fails open rather than rejecting requests. This allows unauthenticated requests to reach command dispatch by bypassing signature verification and replay protection, which can lead to the execution of arbitrary commands.

Recommendations Update to version 2026.4.15 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-1188

CWE-294

CWE-287

Related Identifiers

CVE-2026-44109

GHSA-CJG8-85GJ-V9Q2

GHSA-XH72-V6V9-MWHC

Affected Products

Openclaw

References · 15

• https://github.com/openclaw/openclaw/commit/c8003f1b33ed2924be5f62131bd28742c5a41aae · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-xh72-v6v9-mwhc · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cjg8-85gj-v9q2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xh72-v6v9-mwhc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44109 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://github.com/openclaw/openclaw/pull/66707 · Note
• https://twitter.com/PurpleOps_io/status/2052245139209253372 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2052151287454498907 · Twitter Post
• https://t.me/CVEtracker/52903 · Telegram Post
• https://twitter.com/lyrie_ai/status/2054787933354254366 · Twitter Post
• https://twitter.com/OrizonCyber/status/2052184153370636666 · Twitter Post
• https://twitter.com/CVEnew/status/2052430111748620291 · Twitter Post
• https://vulncheck.com/advisories/openclaw-authentication-bypass-in-feishu-webhook-and-card-action-validation · Note
• https://twitter.com/lyrie_ai/status/2054787932414701923 · Twitter Post