GHSA-5mx2-2mgw-x8rm OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)

• npm openclaw: < 2026.2.21 → fixed in 2026.2.21

Summary BlueBubbles webhook auth in the optional beta iMessage plugin allowed a passwordless fallback path. In some reverse-proxy/local routing setups, this could allow unauthenticated webhook events. Affected Component and Scope • Component: `extensions/bluebubbles` webhook handler • Scope: only deployments using the optional BlueBubbles plugin where webhook password auth was not configured for incoming webhook events Affected Packages / Versions • Package: `openclaw/openclaw` (npm) • Latest published npm version at triage time (2026-02-21): `2026.2.19-2` • Affected structured range: `=2026.2.21`) Details The vulnerable implementation had multiple auth branches, including a passwordless fallback with loopback/proxy heuristics. The fix now uses one authentication codepath: • inbound webhook token/guid must match `channels.bluebubbles.password` • webhook target matching is consolidated to shared plugin-sdk logic • BlueBubbles config validation now requires `password` when `serverUrl` is set Impact BlueBubbles is an optional beta iMessage plugin, and onboarding/channel-add flows already require a password. Practical exposure is mainly custom/manual configurations that omitted webhook password authentication. Remediation • Upgrade to a release that includes this patch (`>=2026.2.21`, planned). • Ensure BlueBubbles webhook delivery includes a matching password (`?password=` or `x-password`). Fix Commit(s) • `6b2f2811dc623e5faaf2f76afaa9279637174590` • `283029bdea23164ab7482b320cb420d1b90df806` Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.21`) so once npm release is out, advisory publish can proceed without additional ticket edits. OpenClaw thanks @zpbrent for reporting.