CVE-2026-32896: OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)
(updated )
BlueBubbles webhook auth in the optional beta iMessage plugin allowed a passwordless fallback path. In some reverse-proxy/local routing setups, this could allow unauthenticated webhook events.
References
- github.com/advisories/GHSA-5mx2-2mgw-x8rm
- github.com/openclaw/openclaw
- github.com/openclaw/openclaw/commit/283029bdea23164ab7482b320cb420d1b90df806
- github.com/openclaw/openclaw/commit/6b2f2811dc623e5faaf2f76afaa9279637174590
- github.com/openclaw/openclaw/security/advisories/GHSA-5mx2-2mgw-x8rm
- nvd.nist.gov/vuln/detail/CVE-2026-32896
- www.vulncheck.com/advisories/openclaw-unauthenticated-webhook-access-via-passwordless-fallback-in-bluebubbles-plugin
Code Behaviors & Features
Detect and mitigate CVE-2026-32896 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →