OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured

NGHIÊM TRỌNG 9.8CVE-2026-32974 · GHSA-g353-mgv3-8pcj · Công bố 29/03/2026 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2026-32974 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng openclaw (openclaw), openclaw.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.25%, cao hơn 16.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2026.3.12 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
openclaw openclaw	`< 2026.3.12`	`2026.3.12`
openclaw npm	`< 2026.3.12`	`2026.3.12`

Mô tả

Summary

Feishu webhook mode allowed deployments that configured only verificationToken without encryptKey. In that state, forged inbound events could be accepted because the weaker configuration did not provide the required cryptographic verification boundary.

Impact

An unauthenticated network attacker who could reach the webhook endpoint could inject forged Feishu events, impersonate senders, and potentially trigger downstream tool execution subject to the local agent policy.

Affected versions

openclaw <= 2026.3.11

Patch

Fixed in openclaw 2026.3.12. Feishu webhook mode now fails closed unless encryptKey is configured, and the webhook transport rejects missing or invalid signatures before dispatch. Update to 2026.3.12 or later and configure encryptKey for webhook deployments.

Mô tả của NVD

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forged Feishu events and trigger downstream tool execution by reaching the webhook endpoint.