OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthenticated requests to reach command dispatch. Missing encryptKey configuration and blank callback tokens fail open instead of rejecting requests, enabling attackers to bypass signature verification and replay protection to execute arbitrary commands.
The vulnerability results from improper handling of missing encryption key configuration (encryptKey) and empty callback tokens — instead of rejecting such requests, the system passes them through (fail open). An attacker can bypass signature verification and replay protection mechanisms. As a result, unauthenticated HTTP requests reach the command dispatch module directly, where arbitrary instructions can be executed.
An attacker without any permissions can remotely execute arbitrary commands on the server (RCE), leading to complete takeover of the OpenClaw instance and potential loss of data confidentiality, integrity, and availability.
Update OpenClaw to version 2026.4.15 or later, where the fix has been introduced (commit c8003f1b). Additionally, ensure that the encryptKey configuration and callback tokens are properly configured and not empty to avoid fail-open mode.
OpenClaw in versions prior to 2026.4.15
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XOpenclaw
APPOpenclaw< 2026.4.15
Related vulnerabilities
OpenClaw: ominięcie uwierzytelniania przez nieodświeżane tokeny bearer po rotacji SecretRef
OpenClaw: Authentication Bypass w trasie pomocniczej sandbox noVNC
OpenClaw: privilege escalation przez pominięcie zdarzeń async exec w heartbeat
OpenClaw: ekspozycja Chrome DevTools Protocol poza sandbox
OpenClaw: nieweryfikowane metadane hooków eskalowane do kontekstu systemowego