OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured
### Summary Feishu webhook mode allowed deployments that configured only `verificationToken` without `encryptKey`. In that state, forged inbound events could be accepted because the weaker configuration did not provide the required cryptographic verification boundary. ### Impact An unauthenticated network attacker who could reach the webhook endpoint could inject forged Feishu events, impersonate senders, and potentially trigger downstream tool execution subject to the local agent policy. ### Affected versions `openclaw` `<= 2026.3.11` ### Patch Fixed in `openclaw` `2026.3.12`. Feishu webhook mode now fails closed unless `encryptKey` is configured, and the webhook transport rejects missing or invalid signatures before dispatch. Update to `2026.3.12` or later and configure `encryptKey` for webhook deployments.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-32974US | critical9.8 | — | ||
OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance o… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/openclaw/openclawPACKAGE
- https://github.com/openclaw/openclaw/commit/7844bc89a1612800810617c823eb0c76ef945804WEB
- https://github.com/openclaw/openclaw/pull/44087WEB
- https://github.com/openclaw/openclaw/releases/tag/v2026.3.12WEB
- https://github.com/openclaw/openclaw/security/advisories/GHSA-g353-mgv3-8pcjWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-32974ADVISORY
- https://www.vulncheck.com/advisories/openclaw-forged-event-injection-via-feishu-webhook-verification-tokenWEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan