OpenClaw < 2026.2.12 - ループバック (loopback) remoteAddress 信頼による Webhook 認証バイパス

The core of this vulnerability lies in the webhook handler's authentication process. Instead of properly validating forwarding headers when operating behind a reverse proxy, it relies solely on the loopback remote address. An attacker positioned behind the proxy can exploit this by crafting malicious requests that bypass the configured webhook passwords. This allows them to inject arbitrary BlueBubbles message and reaction events, effectively impersonating legitimate users or triggering unintended actions within the OpenClaw environment. The potential impact ranges from minor disruptions to significant data manipulation, depending on the permissions associated with the injected events.

Organizations deploying OpenClaw behind reverse proxies, particularly those utilizing the BlueBubbles plugin, are at risk. Shared hosting environments where OpenClaw instances share infrastructure with other tenants are also potentially vulnerable, as an attacker could leverage a compromised tenant to target the OpenClaw webhook endpoint.

• nodejs: Monitor OpenClaw logs for unusual webhook activity originating from unexpected IP addresses.

grep 'webhook' /var/log/openclaw/access.log | grep -v '127.0.0.1'

• nodejs: Check for modifications to the BlueBubbles plugin code that might indicate an attempt to bypass authentication.

find /opt/openclaw/plugins/bluebubbles -type f -mtime -7

• generic web: Examine reverse proxy logs for requests to the OpenClaw webhook endpoint with missing or manipulated forwarding headers. • generic web: Verify that the reverse proxy is configured to properly validate forwarding headers and only allow requests from trusted sources.

1. 2026-03-05Disclosure

   disclosure

1. 予約済み2026-03-04
2. 公開日2026-03-05
3. 更新日2026-03-09
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-29613 is to upgrade OpenClaw to version 2026.2.12 or later, which includes the fix for this authentication bypass. If an immediate upgrade is not feasible, consider implementing a reverse proxy configuration that strictly validates forwarding headers (e.g., X-Forwarded-For, X-Forwarded-Proto) and only allows requests from trusted proxy IPs. Additionally, review and strengthen webhook password policies to ensure they are sufficiently complex and regularly rotated. After upgrade, confirm proper authentication by attempting to trigger a webhook event from a non-proxied network.