CVE-2026-26316: OpenClaw BlueBubbles Webhook Auth Bypass Vulnerability
Summary
CVE-2026-26316: OpenClaw BlueBubbles webhook auth bypass via loopback proxy trust. Affects openclaw versions < 2026.2.13. Fixed in 2026.2.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source framework designed for building applications that interact with various messaging platforms. The BlueBubbles plugin for OpenClaw enables integration with Apple's iMessage, allowing users to send and receive messages through their applications. This plugin, while enhancing functionality, has introduced a security vulnerability that can be exploited if not properly configured.
Vulnerability Detail
The vulnerability arises from the BlueBubbles iMessage channel plugin accepting webhook requests as authenticated based solely on the TCP peer address being loopback (127.0.0.1, ::1, ::ffff:127.0.0.1). This occurs even when the configured webhook secret is missing or incorrect. If an attacker can access the webhook endpoint through a same-host reverse proxy or via Server-Side Request Forgery (SSRF), they may inject unauthorized webhook events into the agent pipeline, potentially leading to unauthorized actions within the application.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.13
This is the first release that contains the fix.
npm install openclaw@2026.2.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, set a non-empty BlueBubbles webhook password to enhance security. Additionally, avoid configurations where a public-facing reverse proxy forwards requests to a loopback-bound Gateway without strong upstream authentication.
Conclusion
The CVE-2026-26316 vulnerability in OpenClaw's BlueBubbles plugin poses a significant risk by allowing unauthorized webhook requests based on loopback addresses. It is crucial to update to the patched versions of the affected packages and implement recommended security measures to mitigate this risk.
See every vulnerability recorded for openclaw →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the package-lock.json file. Visit the Vulert playground at Vulert Scanner to check your application without requiring signup.
If exploited, this vulnerability could allow unauthorized parties to inject malicious webhook events, potentially compromising the integrity and functionality of your application.
No, this vulnerability affects versions of OpenClaw and the BlueBubbles plugin prior to 2026.2.13. Updating to the patched version resolves the issue.
If immediate updates are not possible, implement the recommended workarounds, such as setting a non-empty webhook password and ensuring strong upstream authentication for your reverse proxy.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
