CVE-2026-44109: OpenClaw < 2026.4.15 - Authentication Bypass in Feishu Webhook and Card-Action Validation
OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthenticated requests to reach command dispatch. Missing encryptKey configuration and blank callback tokens fail open instead of rejecting requests, enabling attackers to bypass signature verification and replay protection to execute arbitrary commands.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44109?
CVE-2026-44109 is classified as a critical severity authentication bypass vulnerability.
How do I fix CVE-2026-44109?
To fix CVE-2026-44109, update OpenClaw to version 2026.4.15 or later.
What are the potential impacts of CVE-2026-44109?
CVE-2026-44109 may allow unauthorized access to command dispatch through unauthenticated requests.
Which versions are affected by CVE-2026-44109?
CVE-2026-44109 affects all versions of OpenClaw prior to 2026.4.15.
What features are exploited in CVE-2026-44109?
CVE-2026-44109 exploits authentication in Feishu webhook and card-action validation.