OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured
### Summary Feishu webhook mode allowed deployments that configured only `verificationToken` without `encryptKey`. In that state, forged inbound events could be accepted because the weaker configuration did not provide the required cryptographic verification boundary. ### Impact An unauthenticated network attacker who could reach the webhook endpoint could inject forged Feishu events, impersonate senders, and potentially trigger downstream tool execution subject to the local agent policy. ### Affected versions `openclaw` `<= 2026.3.11` ### Patch Fixed in `openclaw` `2026.3.12`. Feishu webhook mode now fails closed unless `encryptKey` is configured, and the webhook transport rejects missing or invalid signatures before dispatch. Update to `2026.3.12` or later and configure `encryptKey` for webhook deployments.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-32974US | critical9.8 | — | ||
OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance o… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/openclaw/openclawPACKAGE
- https://github.com/openclaw/openclaw/commit/7844bc89a1612800810617c823eb0c76ef945804WEB
- https://github.com/openclaw/openclaw/pull/44087WEB
- https://github.com/openclaw/openclaw/releases/tag/v2026.3.12WEB
- https://github.com/openclaw/openclaw/security/advisories/GHSA-g353-mgv3-8pcjWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-32974ADVISORY
- https://www.vulncheck.com/advisories/openclaw-forged-event-injection-via-feishu-webhook-verification-tokenWEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan