CVE-2026-32896: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32896 is a missing authentication vulnerability in the BlueBubbles webhook handler of OpenClaw, an npm-based messaging platform. The handler contained a passwordless fallback authentication path that, under certain reverse-proxy or local routing configurations, allowed unauthenticated webhook events to be accepted by the BlueBubbles plugin. All OpenClaw versions prior to 2026.2.21 (specifically ≤2026.2.19-2) are affected. The vulnerability was published on March 21, 2026, with patches released on March 23, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-306 (Missing Authentication for Critical Function). The vulnerable handleBlueBubblesWebhookRequest function in extensions/bluebubbles/src/monitor.ts implemented multiple authentication branches: a strict token-matching path and a passwordless fallback that accepted unauthenticated requests when the connection appeared to originate from a direct local loopback (socket address 127.0.0.1/::1 with no forwarding headers). Attackers could exploit this by spoofing or manipulating loopback/proxy heuristics — for example, by sending requests without x-forwarded-for, x-real-ip, or x-forwarded-host headers while connecting from a loopback address — to bypass authentication entirely. The fix eliminates the passwordless fallback, consolidates all authentication to a single codepath requiring a matching channels.bluebubbles.password token, and adds config-schema validation that enforces password presence whenever serverUrl is configured (GitHub Commit 6b2f281, GitHub Commit 283029b).

Successful exploitation allows an unauthenticated attacker to inject arbitrary webhook events into the BlueBubbles iMessage plugin, resulting in low-level confidentiality and integrity impacts — such as unauthorized access to message data and potential manipulation of plugin state. The vulnerability is scoped to deployments using the optional BlueBubbles beta plugin where webhook password authentication was not configured, limiting the practical blast radius to custom or manually configured installations. No availability impact is expected, and lateral movement potential is limited to the messaging context of the affected plugin (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The EPSS score is approximately 0.059% (0.000590), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires specific preconditions: the target must be running the optional BlueBubbles plugin without a configured webhook password, and the attacker must be able to reach the webhook endpoint from a loopback or proxy-adjacent network position (GitHub Advisory).

1. Reconnaissance: Identify an OpenClaw instance running a version ≤2026.2.19-2 with the BlueBubbles beta plugin enabled. Determine the webhook endpoint path (default: /bluebubbles-webhook).
2. Assess network position: Confirm the ability to send requests that appear to originate from a loopback address (e.g., 127.0.0.1) — this may be possible if the attacker has local network access or can reach the service through a misconfigured reverse proxy.
3. Craft unauthenticated request: Send an HTTP POST to the webhook endpoint without any ?password= query parameter, x-password header, x-bluebubbles-guid header, or authorization header. Omit forwarding headers (x-forwarded-for, x-real-ip, x-forwarded-host) to satisfy the loopback heuristic check.
4. Inject webhook event: Include a valid BlueBubbles webhook JSON payload (e.g., {"type": "new-message", "data": {"text": "...", "handle": {"address": "+15551234567"}, "isGroup": false, "isFromMe": false, "guid": "msg-1"}}) in the request body.
5. Achieve unauthorized access: If the passwordless fallback is triggered, the server responds with HTTP 200 and processes the injected event, allowing the attacker to send arbitrary iMessage-related webhook events to the plugin (GitHub Commit 6b2f281, GitHub Advisory).

• Network: Unexpected HTTP POST requests to the BlueBubbles webhook endpoint (e.g., /bluebubbles-webhook) originating from loopback addresses (127.0.0.1, ::1) without authentication parameters (?password=, x-password, x-bluebubbles-guid, authorization headers).
• Logs: OpenClaw application logs showing successful (HTTP 200) webhook processing for requests lacking any password/token field; absence of [bluebubbles] webhook rejected: unauthorized log entries for requests that should have been rejected.
• Logs: Webhook events with unexpected or synthetic message content (e.g., fabricated phone numbers, GUIDs, or message text) appearing in BlueBubbles plugin processing logs.
• Process/Behavior: Unusual iMessage relay activity or unexpected message routing through the BlueBubbles plugin not correlated with legitimate user activity (GitHub Commit 6b2f281).

Upgrade OpenClaw to version 2026.2.21 or later, which removes the passwordless fallback and enforces token authentication for all BlueBubbles webhook requests regardless of network topology (GitHub Advisory). As an immediate workaround, ensure that channels.bluebubbles.password is configured and that the BlueBubbles server is configured to include the matching password in all webhook deliveries (via ?password= query parameter or x-password header). Additionally, implement network-level controls to restrict access to the webhook endpoint to trusted sources only, and review reverse-proxy configurations to ensure they do not inadvertently create loopback-appearing connections from untrusted origins (GitHub Commit 6b2f281).

The vulnerability was reported by researcher @zpbrent and acknowledged in the official GitHub security advisory published by maintainer steipete (GitHub Advisory). The advisory was assigned a "Moderate" severity rating by the project. No significant broader media coverage or notable community commentary beyond the standard CVE tracking feeds has been observed for this vulnerability.