Quick answers
- Is CVE-2026-44109 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-44109 being exploited in the wild.
- How severe is CVE-2026-44109?
- Critical severity, with a CVSS score of 9.8, published 6 May 2026.
- Which products and versions are affected?
- Openclaw < 2026.4.15.
- Is there a fix for CVE-2026-44109?
- A patch was published on 2026-04-15: Version 2026.4.15 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-44109 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-44109?
- Check whether you run Openclaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authentication bypass affecting Feishu webhook and card-action validation in OpenClaw. Two fail-open conditions allow requests to bypass security checks: (1) webhook mode accepts missing encryptKey configuration as valid instead of rejecting startup, and (2) card-action callbacks with blank tokens are treated as usable instead of being rejected before dispatch. The vulnerability requires network access to the webhook endpoint but no prior authentication or user interaction. An attacker can send unauthenticated or replayed requests directly to command handling without valid Feishu signatures or replay tokens. The fix in version 2026.4.15 enforces fail-closed validation: refusing webhook startup without encryptKey, returning 401 for invalid signatures, and rejecting blank callback tokens at the lifecycle guard.
Affected products
- OpenClaw OpenClaw < 2026.4.15
Identifiers
- CVE-2026-44109
- GHSA-xh72-v6v9-mwhc
Timeline
- 2026-04-17: disclosed
- 2026-04-15: patched: Version 2026.4.15 released