{"cve":"CVE-2026-29613","nvd":{"published":"2026-03-05T22:16:24.850","modified":"2026-06-17T10:29:49.883","status":"Analyzed","description":"OpenClaw versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles (optional plugin) webhook handler in which it authenticates requests based solely on loopback remoteAddress without validating forwarding headers, allowing bypass of configured webhook passwords. When the gateway operates behind a reverse proxy, unauthenticated remote attackers can inject arbitrary BlueBubbles message and reaction events by reaching the proxy endpoint.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.2},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","score":5.9},"cwes":["CWE-306"],"references":["https://github.com/openclaw/openclaw/commit/743f4b28495cdeb0d5bf76f6ebf4af01f6a02e5a","https://github.com/openclaw/openclaw/commit/f836c385ffc746cb954e8ee409f99d079bfdcd2f","https://github.com/openclaw/openclaw/security/advisories/GHSA-xc7w-v5x6-cc87","https://www.vulncheck.com/advisories/openclaw-webhook-authentication-bypass-via-loopback-remoteaddress-trust"],"products":["openclaw:openclaw"],"source":"nvd","synced_at":"2026-10-19T22:25:53.701907451+00:00"},"epss":{"cve":"CVE-2026-29613","score":0.00464,"percentile":0.40202,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-xc7w-v5x6-cc87","url":"https://osv.dev/vulnerability/GHSA-xc7w-v5x6-cc87","summary":"OpenClaw has a webhook auth bypass when gateway is behind a reverse proxy (loopback remoteAddress trust)","modified":"2026-03-06T01:16:23.443327Z","packages":[{"ecosystem":"npm","name":"openclaw","purl":"pkg:npm/openclaw","ranges":["<2026.2.12"],"fixed":["2026.2.12"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}