GitHub Advisoryadvisory · npm

GHSA-g353-mgv3-8pcj OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured

HIGH Published 2026-03-13 Modified 2026-04-06 Official page ↗
Aliases
CVE-2026-32974
Ecosystem
npm
Packages
openclaw
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Weaknesses
CWE-347
Reviewed
2026-03-13

Affected packages

• npm openclaw: < 2026.3.12 → fixed in 2026.3.12

Description

Summary Feishu webhook mode allowed deployments that configured only `verificationToken` without `encryptKey`. In that state, forged inbound events could be accepted because the weaker configuration did not provide the required cryptographic verification boundary. Impact An unauthenticated network attacker who could reach the webhook endpoint could inject forged Feishu events, impersonate senders, and potentially trigger downstream tool execution subject to the local agent policy. Affected versions `openclaw` `<= 2026.3.11` Patch Fixed in `openclaw` `2026.3.12`. Feishu webhook mode now fails closed unless `encryptKey` is configured, and the webhook transport rejects missing or invalid signatures before dispatch. Update to `2026.3.12` or later and configure `encryptKey` for webhook deployments.

Related

Alias · CVE (1)

  • CVE-2026-32974 OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured… vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References