CVE-2026-29613: OpenClaw < 2026.2.12 - Webhook Authentication Bypass via Loopback remoteAddress Trust
OpenClaw versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles (optional plugin) webhook handler in which it authenticates requests based solely on loopback remoteAddress without validating forwarding headers, allowing bypass of configured webhook passwords. When the gateway operates behind a reverse proxy, unauthenticated remote attackers can inject arbitrary BlueBubbles message and reaction events by reaching the proxy endpoint.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29613?
CVE-2026-29613 is categorized as a high-severity vulnerability due to its potential to bypass authentication mechanisms.
How do I fix CVE-2026-29613?
To fix CVE-2026-29613, upgrade OpenClaw to version 2026.2.12 or later where the vulnerability has been addressed.
What specifically is affected by CVE-2026-29613?
CVE-2026-29613 specifically affects the BlueBubbles optional plugin in OpenClaw versions prior to 2026.2.12.
What type of attack does CVE-2026-29613 allow?
CVE-2026-29613 allows attackers to authenticate requests by exploiting the trust in loopback remoteAddress without proper validation.
Is CVE-2026-29613 exploitable remotely?
Yes, CVE-2026-29613 is exploitable remotely, making it critical to patch affected systems as soon as possible.