Openclaw cli: OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured (CVE-2026-32974)

The OpenClaw CLI Feishu webhook mode had a security weakness when configured solely with a verificationToken and lacking an encryptKey. This configuration failed to provide a cryptographic verification boundary, allowing unauthenticated network attackers to send forged Feishu events to the webhook endpoint. Such forged events could impersonate legitimate senders and potentially cause execution of downstream tools as permitted by local agent policies. The vulnerability affects versions from 2026.1.29 up to but not including 2026.3.12. The issue is resolved in version 2026.3.12 by requiring encryptKey configuration and rejecting requests with missing or invalid signatures.

An unauthenticated attacker who can reach the webhook endpoint may inject forged Feishu events, impersonate legitimate senders, and potentially trigger execution of downstream tools according to local agent policies. This could lead to unauthorized actions and compromise of the affected system's integrity and availability. The CVSS v3.1 score is 8.6 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on integrity and availability.

A patch is available and should be applied by upgrading OpenClaw CLI to version 2026.3.12 or later. The fix enforces that Feishu webhook mode fails closed unless an encryptKey is configured and rejects missing or invalid signatures before processing events. Deployments must configure the encryptKey parameter for webhook security. No additional mitigation is required once updated and properly configured.