An authentication bypass vulnerability in OpenClaw allows unauthenticated attackers to execute arbitrary downstream actions by injecting forged Feishu webhook events.

The application fails to properly verify cryptographic signatures when only a verificationToken is configured without an encryptKey. This allows unauthenticated network attackers to send malicious, forged events to the webhook endpoint, which the system then erroneously accepts as legitimate.

The ability for an unauthenticated attacker to inject forged events presents a significant risk to system integrity and operational security. By triggering downstream tool execution, an attacker could potentially manipulate business workflows, exfiltrate data, or cause unauthorized system actions, justifying the high CVSS score of 8.6.

Immediate Action: Update the OpenClaw package to version 2026.3.12 or later to ensure cryptographic signature verification is enforced.

Proactive Monitoring: Review web server and application access logs for unusual traffic patterns directed at the Feishu webhook endpoint, specifically looking for high volumes of requests originating from unauthorized IP addresses.

Compensating Controls: If an immediate update is not feasible, restrict access to the webhook endpoint at the network or firewall level to only allow traffic originating from trusted Feishu service IP ranges.

Public Exploit Available: Unknown.

Given the potential for unauthorized downstream tool execution, this vulnerability poses a critical risk to integrated environments. Administrators should prioritize upgrading to version 2026.3.12 immediately. If the software is exposed to the public internet, ensure that strict ingress filtering is applied to the webhook endpoint until the patch can be deployed.