Vulnerability record · CVE-2026-29613 · published 5 March 2026

CVE-2026-29613: Openclaw missing authentication for critical function vulnerability

Openclaw · Openclaw

OpenClaw versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles (optional plugin) webhook handler in which it authenticates requests based solely on loopback remoteAddress without validating forwarding headers, allowing bypass of configured webhook passwords. When the gateway operates behind a reverse proxy, unauthenticated remote attackers can inject arbitrary BlueBubbles message and reaction events by reaching the proxy endpoint.

8.2 CVSS 4.0 High EPSS 0.60% · top 53.2% CWE-306 · Missing authentication for critical function

8.2CVSS 4.0 base score

0.60%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Openclaw Openclaw

References

Link	Tags
https://github.com/openclaw/openclaw/commit/743f4b28495cdeb0d5bf76f6ebf4af01f6a02e5a	Patch
https://github.com/openclaw/openclaw/commit/f836c385ffc746cb954e8ee409f99d079bfdcd2f	Patch
https://github.com/openclaw/openclaw/security/advisories/GHSA-xc7w-v5x6-cc87	Third Party Advisory
https://www.vulncheck.com/advisories/openclaw-webhook-authentication-bypass-via-loopback-remoteaddress-trust	Third Party Advisory

Track CVE-2026-29613 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-30741Openclaw code injection vulnerabilityA remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers to execute arbitrary code via a Request-Side prompt…EPSS 1.2%11 Mar 2026 9.4CVE-2026-33579Openclaw incorrect authorization vulnerabilityOpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into th…EPSS 0.51%31 Mar 2026 9.4CVE-2026-32978Openclaw incorrect authorization vulnerabilityOpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain scri…EPSS 0.32%29 Mar 2026 9.4CVE-2026-32922Openclaw vulnerabilityOpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to min…EPSS 0.69%29 Mar 2026 9.4CVE-2026-22172Openclaw missing authorization vulnerabilityOpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that allows shared-token or password…EPSS 0.56%20 Mar 2026 9.4CVE-2026-28466Openclaw incorrect authorization vulnerabilityOpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it fails to sanitize internal approval fields in node.invoke par…EPSS 0.67%5 Mar 2026 9.3CVE-2026-43534Openclaw insufficient verification of data authenticity vulnerabilityOpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events. Atta…EPSS 0.30%5 May 2026 9.3CVE-2026-32987Openclaw authentication bypass by capture-replay vulnerabilityOpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers …EPSS 0.61%29 Mar 2026

Source: NIST National Vulnerability Database (record CVE-2026-29613), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.