Executive brief
OpenClaw is an open-source webhook automation platform. When configured to use Feishu (a team collaboration tool) webhooks with only a verification token and no encryption key, the platform accepts forged webhook events from any network attacker. This allows attackers to impersonate legitimate Feishu notifications and trigger unintended automation workflows on the system.
Technical details
This is an authentication bypass vulnerability (CWE-347: Improper Verification of Cryptographic Signature) in OpenClaw's Feishu webhook mode. The root cause is insufficient verification when only verificationToken is configured without an encryptKey. The vulnerability allows unauthenticated network attackers to send crafted webhook events to the endpoint, bypassing cryptographic validation. An attacker can inject forged Feishu events and potentially trigger downstream tool execution subject to local agent policy. The fix, available in version 2026.3.12, implements fail-closed behavior requiring encryptKey and validates signatures before dispatch.
Affected products
- OpenClaw OpenClaw <= 2026.3.11
Timeline
- 2026-03-13: disclosed
- 2026-03-12: patched: Fixed in version 2026.3.12