CVE-2026-32974: OpenClaw < 2026.3.12 - Forged Event Injection via Feishu Webhook Verification Token
OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forged Feishu events and trigger downstream tool execution by reaching the webhook endpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.3.12 - Configuration
Do not rely solely on verificationToken — configure a non-empty encryptKey for the Feishu webhook so that events require the encryptKey in addition to verificationToken.
OpenClaw Feishu webhook encryptKey = non-empty (configured)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32974?
CVE-2026-32974 is considered a high severity vulnerability due to its potential for unauthorized access and event injection.
How do I fix CVE-2026-32974?
To fix CVE-2026-32974, upgrade OpenClaw to version 2026.3.12 or later.
What type of vulnerability is CVE-2026-32974?
CVE-2026-32974 is an authentication bypass vulnerability affecting the Feishu webhook mode.
Who is affected by CVE-2026-32974?
Users of OpenClaw versions prior to 2026.3.12 are affected by CVE-2026-32974.
What does CVE-2026-32974 allow an attacker to do?
CVE-2026-32974 allows an attacker to submit forged events due to the lack of proper webhook verification.