OpenClaw Vulnerability: BlueBubbles Plugin Webhook Authentication Flaw
Summary
GHSA-5mx2-2mgw-x8rm: OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback). Affects openclaw/openclaw versions < 2026.2.21. Fixed in 2026.2.21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenClaw is an open-source project that provides a framework for building applications with a focus on extensibility and integration. One of its components, the BlueBubbles plugin, allows users to integrate iMessage functionalities into their applications. This plugin is currently in beta and offers features that enhance user experience by allowing webhook interactions. However, a recent vulnerability has been identified in the webhook authentication mechanism, which could potentially expose users to unauthorized access.
Vulnerability Detail
The vulnerability arises from the BlueBubbles webhook authentication process, which previously allowed a passwordless fallback path. This flaw could enable unauthenticated webhook events in specific configurations, particularly in reverse-proxy or local routing setups. The implementation had multiple authentication branches, including a fallback that did not require a password. This could lead to unauthorized access to sensitive webhook events, posing a security risk to users who have not configured password authentication for incoming webhook events.
How To Fix
Minimum fixed version
2026.2.21
This is the first release that contains the fix.
npm install openclaw/openclaw@2026.2.21Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually configure their webhook settings to ensure that password authentication is enforced. This can be done by ensuring that the webhook delivery includes a password, either by modifying the request URL or by setting the appropriate headers.
Conclusion
In summary, the OpenClaw vulnerability in the BlueBubbles plugin poses a risk due to its flawed webhook authentication process. Users are advised to upgrade to the latest patched version to secure their applications. Implementing the recommended fixes and workarounds will help mitigate potential unauthorized access.
See every vulnerability recorded for openclaw/openclaw →
FAQ
The vulnerability allows unauthenticated webhook events due to a passwordless fallback in the BlueBubbles plugin's authentication process.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.9, indicating a moderate level of risk.
If you cannot upgrade immediately, ensure that your webhook settings require a password for authentication to mitigate the risk.
The vulnerability was reported by a user identified as @zpbrent.
