OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured

緊急 9.8CVE-2026-32974 · GHSA-g353-mgv3-8pcj · 29/03/2026 公開 · 17/06/2026 更新

要点

CVE-2026-32974 は openclaw (openclaw), openclaw に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.25%（全脆弱性の 16.5% より高い）。
対処：2026.3.12 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
openclaw openclaw	`< 2026.3.12`	`2026.3.12`
openclaw npm	`< 2026.3.12`	`2026.3.12`

概要

Summary

Feishu webhook mode allowed deployments that configured only verificationToken without encryptKey. In that state, forged inbound events could be accepted because the weaker configuration did not provide the required cryptographic verification boundary.

Impact

An unauthenticated network attacker who could reach the webhook endpoint could inject forged Feishu events, impersonate senders, and potentially trigger downstream tool execution subject to the local agent policy.

Affected versions

openclaw <= 2026.3.11

Patch

Fixed in openclaw 2026.3.12. Feishu webhook mode now fails closed unless encryptKey is configured, and the webhook transport rejects missing or invalid signatures before dispatch. Update to 2026.3.12 or later and configure encryptKey for webhook deployments.

NVD の説明

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forged Feishu events and trigger downstream tool execution by reaching the webhook endpoint.