Openclaw cli: OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback) (CVE-2026-32896)
Description
CVE-2026-32896 is a medium severity vulnerability in the OpenClaw CLI's optional BlueBubbles beta iMessage plugin webhook authentication. The flaw allowed a passwordless fallback authentication path in certain reverse-proxy or local routing setups, potentially permitting unauthenticated webhook events. This affects deployments using the BlueBubbles plugin without configured webhook password authentication. The issue is fixed in version 2026.2.21 and later by enforcing a single authentication codepath requiring a matching webhook token/password.
CVSS v3.1
Score 4.8medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The BlueBubbles webhook handler in the OpenClaw CLI's optional beta iMessage plugin had multiple authentication branches, including a passwordless fallback that relied on loopback/proxy heuristics. This fallback could allow unauthenticated webhook events in some configurations where password authentication was omitted. The vulnerability affects versions up to and including 2026.2.19-2. The fix consolidates authentication to require the inbound webhook token to match the configured password, and configuration validation now mandates a password when a server URL is set. The patch is planned for release in version 2026.2.21.
Potential Impact
This vulnerability could allow unauthenticated webhook events in custom or manual configurations of the BlueBubbles plugin that omit webhook password authentication. Since BlueBubbles is an optional beta plugin and onboarding flows require a password, practical exposure is limited to misconfigured deployments. The CVSS 3.1 base score is 4.8 (medium), reflecting low confidentiality and integrity impact and no availability impact.
Mitigation Recommendations
Upgrade to OpenClaw CLI version 2026.2.21 or later, which includes the patch removing the passwordless fallback. Ensure that BlueBubbles webhook delivery includes a matching password via query parameter or header. No other mitigations are indicated as the fix is available and planned for imminent release.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-32896
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac245b812601ec6a3166bc7
Added to database: 10/04/2026, 12:25:28 UTC
Last enriched: 10/04/2026, 13:00:58 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.