CVE-2026-32896: OpenClaw auth bypass

CISO Take

The BlueBubbles webhook handler in OpenClaw prior to version 2026.2.21 contains a passwordless fallback authentication path that activates under reverse-proxy or loopback routing conditions—a deployment pattern common in containerized and cloud-native AI agent stacks. Despite a moderate CVSS of 4.8, this vulnerability sits in the top 84th EPSS percentile, and the package carries 396 documented CVEs, signaling entrenched security debt that compounds aggregate risk beyond this single finding. Because OpenClaw is an AI agent platform, successful exploitation allows an adversary to inject unauthenticated webhook events that trigger unintended agent tool invocations or manipulate agent workflows without any valid session or credentials. Teams should patch to 2026.2.21 immediately and audit reverse-proxy configurations to ensure no headers expose the loopback fallback path to external traffic.

Sources: NVD EPSS CISA KEV GitHub Advisory ATLAS vulncheck.com

What is the risk?

Moderate overall risk with elevated exploitation probability relative to CVSS score. EPSS top-84th percentile indicates meaningful real-world exploitation likelihood despite no public exploit or KEV listing. Attack complexity is HIGH, requiring specific reverse-proxy or loopback routing conditions, which limits opportunistic mass scanning but is routinely satisfied in production AI agent deployments behind Nginx, Caddy, or API gateways. The 396 prior CVEs in the same package are a significant risk multiplier indicating systemic security quality issues rather than isolated defects.

How does the attack unfold?

Reconnaissance

Attacker identifies an OpenClaw instance with BlueBubbles plugin exposed via reverse proxy, confirming the routing configuration through HTTP response headers or service fingerprinting.

AML.T0006

Initial Access

Attacker crafts HTTP requests with spoofed loopback or proxy-forwarding headers (e.g., X-Forwarded-For: 127.0.0.1) that trigger the passwordless fallback authentication path in the BlueBubbles webhook handler.

AML.T0049

Unauthorized Agent Invocation

Attacker submits arbitrary unauthenticated webhook events that the AI agent processes as legitimate, triggering unintended tool calls or injecting adversary-controlled instructions into the agent workflow.

AML.T0053

Impact

Agent executes unauthorized tool invocations—potentially exfiltrating data, accessing connected systems, or propagating malicious instructions—resulting in confidentiality and integrity compromise.

AML.T0086

Reconnaissance

Attacker identifies an OpenClaw instance with BlueBubbles plugin exposed via reverse proxy, confirming the routing configuration through HTTP response headers or service fingerprinting.

AML.T0006

Initial Access

Attacker crafts HTTP requests with spoofed loopback or proxy-forwarding headers (e.g., X-Forwarded-For: 127.0.0.1) that trigger the passwordless fallback authentication path in the BlueBubbles webhook handler.

AML.T0049

Unauthorized Agent Invocation

Attacker submits arbitrary unauthenticated webhook events that the AI agent processes as legitimate, triggering unintended tool calls or injecting adversary-controlled instructions into the agent workflow.

AML.T0053

Impact

Agent executes unauthorized tool invocations—potentially exfiltrating data, accessing connected systems, or propagating malicious instructions—resulting in confidentiality and integrity compromise.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

4.8 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 16% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C Low

I Low

A None

What should I do?

5 steps

Patch: Upgrade OpenClaw to version 2026.2.21 or later (commits 6b2f2811 and 283029bd apply the fix).
Network hardening: Configure reverse proxies to strip loopback and forwarding headers (X-Forwarded-For, X-Real-IP) before they reach the BlueBubbles webhook handler, preventing exploitation of the proxy heuristic.
Restrict access: Place the BlueBubbles webhook endpoint behind authentication middleware independent of the plugin's own auth logic.
Detection: Alert on unauthenticated POST requests to BlueBubbles webhook routes; monitor for webhook events without valid auth tokens in application logs.
Audit: Review all OpenClaw deployments for CVE exposure given the 396-CVE history—treat this as a prompt to assess whether OpenClaw meets your security baseline.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0080 - AI Agent Context Poisoning AML.T0091 - Use Alternate Authentication Material

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.2 - AI system security controls

NIST AI RMF

MANAGE 2.2 - Mechanisms to respond to identified AI risks

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32896?

The BlueBubbles webhook handler in OpenClaw prior to version 2026.2.21 contains a passwordless fallback authentication path that activates under reverse-proxy or loopback routing conditions—a deployment pattern common in containerized and cloud-native AI agent stacks. Despite a moderate CVSS of 4.8, this vulnerability sits in the top 84th EPSS percentile, and the package carries 396 documented CVEs, signaling entrenched security debt that compounds aggregate risk beyond this single finding. Because OpenClaw is an AI agent platform, successful exploitation allows an adversary to inject unauthenticated webhook events that trigger unintended agent tool invocations or manipulate agent workflows without any valid session or credentials. Teams should patch to 2026.2.21 immediately and audit reverse-proxy configurations to ensure no headers expose the loopback fallback path to external traffic.

Is CVE-2026-32896 actively exploited?

No confirmed active exploitation of CVE-2026-32896 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32896?

1. Patch: Upgrade OpenClaw to version 2026.2.21 or later (commits 6b2f2811 and 283029bd apply the fix). 2. Network hardening: Configure reverse proxies to strip loopback and forwarding headers (X-Forwarded-For, X-Real-IP) before they reach the BlueBubbles webhook handler, preventing exploitation of the proxy heuristic. 3. Restrict access: Place the BlueBubbles webhook endpoint behind authentication middleware independent of the plugin's own auth logic. 4. Detection: Alert on unauthenticated POST requests to BlueBubbles webhook routes; monitor for webhook events without valid auth tokens in application logs. 5. Audit: Review all OpenClaw deployments for CVE exposure given the 396-CVE history—treat this as a prompt to assess whether OpenClaw meets your security baseline.

What systems are affected by CVE-2026-32896?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, webhook-integrated AI agents, reverse-proxy-deployed AI services.

What is the CVSS score for CVE-2026-32896?

CVE-2026-32896 has a CVSS v3.1 base score of 4.8 (MEDIUM). The EPSS exploitation probability is 0.25%.

What is the AI security impact?

Affected AI Architectures

agent frameworkswebhook-integrated AI agentsreverse-proxy-deployed AI services

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0080 AI Agent Context Poisoning

AML.T0091 Use Alternate Authentication Material

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.2

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations. Attackers can bypass webhook authentication by exploiting the loopback/proxy heuristics to send unauthenticated webhook events to the BlueBubbles plugin.

Exploitation Scenario

An adversary scans for OpenClaw instances behind reverse proxies (common in Docker/Kubernetes AI agent deployments). By crafting HTTP requests that include loopback or proxy-forwarding headers (e.g., X-Forwarded-For: 127.0.0.1), the attacker triggers the passwordless fallback path in the BlueBubbles webhook handler. The handler accepts the request as authenticated, allowing the attacker to submit arbitrary webhook events—such as fake inbound messages or commands—that the AI agent processes and acts upon. If the agent has tool access to file systems, APIs, or communication channels, the attacker can pivot from the webhook bypass to unauthorized data access or exfiltration.

Weaknesses (CWE)

CWE-306 Missing Authentication for Critical Function

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.