CVE-2026-29613: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-29613 is a webhook authentication bypass vulnerability in OpenClaw's optional BlueBubbles plugin that allows unauthenticated remote attackers to inject arbitrary message and reaction events. The flaw affects all OpenClaw (npm) versions prior to 2026.2.12 and was disclosed on March 5, 2026. It carries a CVSS v3.1 base score of 5.9 (Medium) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, Feedly).

The root cause is CWE-306 (Missing Authentication for Critical Function): the BlueBubbles webhook handler in extensions/bluebubbles/src/monitor.ts authenticated incoming HTTP POST requests solely by checking whether req.socket.remoteAddress was a loopback address (127.0.0.1, ::1, or ::ffff:127.0.0.1), without validating any forwarding headers or requiring the configured webhook password. When OpenClaw Gateway is deployed behind a reverse proxy (e.g., Tailscale Serve/Funnel, nginx, Cloudflare Tunnel, or ngrok), the proxy connects to the gateway over loopback, so any remote request forwarded by the proxy appears to originate from loopback and is accepted without credentials. An attacker who can reach the proxy's public endpoint can send crafted HTTP POST requests to the BlueBubbles webhook path and inject arbitrary new-message or reaction events into the gateway (GitHub Advisory, Patch Commit).

Successful exploitation allows unauthenticated remote attackers to inject arbitrary BlueBubbles message and reaction events into the OpenClaw gateway, compromising the integrity of the messaging pipeline. There is no confidentiality or availability impact — attackers cannot read existing messages or crash the service — but they can fabricate inbound messages or reactions that the gateway processes as legitimate, potentially triggering automated workflows or deceiving users. The attack is limited to deployments where the BlueBubbles plugin is enabled and the gateway is exposed through a reverse proxy (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.026%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to be able to reach the reverse proxy endpoint and knowledge that the BlueBubbles plugin is enabled — conditions that limit the attack surface to a subset of OpenClaw deployments.

1. Reconnaissance: Identify internet-facing OpenClaw gateway instances running behind a reverse proxy (e.g., via Shodan/Censys searches for the default BlueBubbles webhook path, or by probing known proxy endpoints) with the BlueBubbles plugin enabled.
2. Identify the webhook endpoint: Determine the configured BlueBubbles webhook path (default pattern: /bluebubbles-webhook) exposed through the reverse proxy's public URL.
3. Craft a malicious HTTP POST request: Construct a POST request to the proxy's public endpoint targeting the webhook path, with a JSON body mimicking a legitimate BlueBubbles event, e.g.:

{
  "type": "new-message",
  "data": {
    "text": "injected message",
    "handle": { "address": "+15551234567" },
    "isGroup": false,
    "isFromMe": false,
    "guid": "fake-guid-001"
  }
}

4. Send without credentials: Submit the request without any password, guid query parameter, or authentication header. The reverse proxy forwards the request to the gateway over loopback; the vulnerable handler sees remoteAddress = 127.0.0.1 and accepts it as authenticated.
5. Achieve event injection: The gateway processes the fabricated event as a legitimate inbound BlueBubbles message or reaction, potentially triggering automated responses, agent workflows, or deceiving end users (GitHub Advisory, Patch Commit).

• Network: Unexpected HTTP POST requests to the BlueBubbles webhook path (e.g., /bluebubbles-webhook) from external IPs arriving at the reverse proxy without authentication headers or password query parameters; anomalous spikes in webhook request volume from unfamiliar source IPs.
• Logs: Gateway access logs showing 200 OK responses to webhook POST requests that lack password/guid query parameters or x-guid/x-password/authorization headers; requests with x-forwarded-for headers containing external IP addresses being accepted without credentials (in vulnerable versions).
• Application Behavior: Unexpected inbound messages or reaction events appearing in the OpenClaw gateway that do not correspond to actual BlueBubbles server activity; fabricated message GUIDs or phone numbers not matching known contacts (GitHub Advisory).

Upgrade OpenClaw (npm) to version 2026.2.12 or later, which removes the loopback-based authentication bypass and requires the configured webhook secret for all requests (commit f836c385) (GitHub Advisory, Patch Commit). A defense-in-depth follow-up commit (743f4b28) further hardens the handler to detect forwarding headers and reject passwordless webhooks from proxied requests (Defense Commit). Until patching is complete: (1) ensure a strong BlueBubbles webhook password is configured; (2) restrict network access to the webhook endpoint at the reverse proxy or firewall level; (3) do not expose the gateway webhook endpoint publicly without authentication.

The vulnerability was reported by researcher @simecek and analyzed by stanislavfortaisle, with the advisory published by steipete on GitHub (GitHub Advisory). VulnCheck published an advisory covering the authentication bypass (VulnCheck Advisory). Social media activity was limited, with mentions on Bluesky and Mastodon aggregating the CVE disclosure, and a technical write-up published at infinitsec.net shortly after disclosure.