OpenClaw vulnerabilities

252 known CVE vulnerabilities in OpenClaw, translated and rated.

CVE-2026-32896Medium
The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations. Attackers can bypass webhook authentication by exploiting loopback/proxy heuristics.
CVE-2026-28465Medium
OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification. Attackers can bypass verification by supplying untrusted Forwarded or X-Forwarded-* headers in reverse-proxy configurations that implicitly trust these headers.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS