Openclaw cli: OpenClaw: Feishu webhook and card-action validation now fail closed (CVE-2026-44109)

OpenClaw CLI's Feishu webhook mode accepted missing encryptKey configuration as valid and allowed blank card-action callback tokens, resulting in fail-open validation paths. This could permit unauthenticated webhook or card-action requests to reach command dispatch in affected deployments. The vulnerability affects versions prior to 2026.4.15. The patch in 2026.4.15 enforces fail-closed validation by refusing to start webhook mode without encryptKey, returning invalid on missing signing configuration, rejecting invalid signatures with 401 responses, and rejecting blank card-action callback tokens before dispatch.

Deployments using Feishu webhook mode without a configured encryptKey or handling malformed card-action callbacks with blank tokens may allow unauthenticated network-triggered requests to reach OpenClaw command handling. This exposes a critical security risk as it bypasses expected Feishu signature and replay protections, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

Upgrade OpenClaw CLI to version 2026.4.15 or later, which includes the official fix that enforces fail-closed validation for Feishu webhook and card-action handling. This version refuses to start webhook mode without an encryptKey, rejects invalid signatures before processing, and drops blank card-action callback tokens before dispatch. No additional mitigation is required once patched.