An authorization bypass vulnerability in OpenClaw's webhook mode allows unauthenticated attackers to manipulate data processing via forged requests.

This flaw (CWE-345) involves the failure to properly verify the authenticity of incoming webhook payloads, permitting unauthenticated remote attackers to bypass authorization controls.

Exploitation of this vulnerability could allow an attacker to inject unauthorized data or trigger malicious actions within the webhook processing workflow. With a CVSS score of 7.5, this high-severity issue poses a significant risk to application integrity and could lead to unauthorized state changes.

Immediate Action: Update the OpenClaw package to version 2026.2.1 or later to implement proper verification of webhook authenticity.

Proactive Monitoring: Review application and webhook logs for anomalous payloads or requests that fail validation checks.

Compensating Controls: Implement strict IP whitelisting for incoming webhook traffic to ensure that only trusted sources can communicate with the endpoint.

Public Exploit Available: Unknown.

Security teams should immediately upgrade to the patched version of OpenClaw to ensure that all incoming webhooks are cryptographically verified. Failure to patch may allow attackers to bypass critical authorization logic.