Executive brief
OpenClaw is an AI agent framework that includes an optional BlueBubbles plugin for iMessage integration. The plugin accepted webhook events with a passwordless fallback mechanism in certain reverse-proxy or loopback routing configurations, allowing an attacker to send unauthenticated webhook events to the gateway. This could enable unauthorized iMessage functionality or message injection without proper authentication.
Technical details
The BlueBubbles webhook handler in OpenClaw contained multiple authentication code paths including a passwordless fallback with loopback/proxy heuristics (CWE-306: Missing Authentication for Critical Function). In deployments where webhook password authentication was not explicitly configured, an attacker positioned on the network or able to send HTTP requests to a reverse proxy or loopback interface could bypass authentication by exploiting these heuristics. The fix consolidates all webhook authentication to a single code path requiring inbound webhook tokens/GUIDs to match the configured channels.bluebubbles.password, and enforces that password authentication is configured whenever serverUrl is set. The attack requires network access to the webhook endpoint but no prior authentication or user interaction. Patches are available in version 2026.2.21 and later.
Affected products
- OpenClaw openclaw <=2026.2.19-2
Timeline
- 2026-03-03: disclosed: GHSA-5mx2-2mgw-x8rm published
- 2026-02-21: patched: Fix commits made; patch planned for version 2026.2.21
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-5mx2-2mgw-x8rm
- https://github.com/openclaw/openclaw/commit/283029bdea23164ab7482b320cb420d1b90df806
- https://github.com/openclaw/openclaw/commit/6b2f2811dc623e5faaf2f76afaa9279637174590
- https://github.com/openclaw/openclaw
- https://www.vulncheck.com/advisories/openclaw-unauthenticated-webhook-access-via-passwordless-fallback-in-bluebubbles-plugin