OpenClaw authentication bypass in Feishu webhook and card-action validation

Executive brief

OpenClaw, an automation platform, contains a security flaw in its Feishu integration that allows unauthorized commands to be executed. Due to a 'fail-open' design, the system would accept webhooks and card actions even if security keys were missing or tokens were blank. This could allow an attacker to bypass authentication and trigger internal commands, potentially leading to unauthorized data access or system manipulation.

Technical details

OpenClaw versions prior to 2026.4.15 suffer from an authentication bypass in the Feishu extension. The vulnerability stems from two 'fail-open' conditions: the webhook transport accepted missing 'encryptKey' configurations as valid, and the card-action lifecycle guard accepted blank callback tokens. An unauthenticated remote attacker can exploit these paths to bypass signature verification and replay protection, reaching the command dispatch layer. The fix in version 2026.4.15 ensures the system fails closed by requiring an 'encryptKey' to start and rejecting invalid signatures or blank tokens with a 401 error.

Affected products

• OpenClaw openclaw < 2026.4.15

Timeline

• 2026-04-16: patched: Version 2026.4.15 released
• 2026-04-17: advisory: GitHub Advisory published

References

• https://api.github.com/users/dhyabi2
• https://github.com/dhyabi2
• https://api.github.com/users/dhyabi2/gists%7B/gist_id%7D
• https://api.github.com/users/dhyabi2/repos
• https://avatars.githubusercontent.com/u/32069256?v=4
• https://api.github.com/users/dhyabi2/events%7B/privacy%7D