CVE-2026-32974: OpenClaw auth bypass triggers forged

CISO Take

OpenClaw's Feishu webhook integration accepts forged events without cryptographic verification when only `verificationToken` is configured and `encryptKey` is absent — the common default deployment posture — allowing any unauthenticated network attacker to inject arbitrary webhook events. At CVSS 8.6 with no privileges or user interaction required, and ranking in the top 84th EPSS percentile, this is immediately reachable by unsophisticated actors against any internet-exposed instance. The critical risk is downstream: forged events trigger OpenClaw's tool execution stack autonomously, meaning the blast radius maps directly to whatever system permissions the agent holds — shell access, file systems, API credentials, or connected data pipelines. Patch immediately to version 2026.3.12; if patching is not immediately possible, configure `encryptKey` in the Feishu webhook settings and restrict the endpoint to Feishu's published IP ranges at the network perimeter.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

High risk with immediate exploitability. The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N) describes a zero-friction network attack requiring no credentials, no prior access, and no victim interaction. The EPSS top-84th-percentile ranking elevates this above the vast majority of disclosed CVEs in near-term exploitation likelihood. CWE-347 (Improper Verification of Cryptographic Signature) is a well-understood vulnerability class with straightforward exploitation mechanics — forging a Feishu-style webhook POST is within script-kiddie capability once the endpoint is located. The absence of a public exploit or Nuclei template provides limited protection given the low technical barrier. Risk compounds significantly in environments where OpenClaw agents hold broad tool permissions, converting a single webhook request into potential full environment compromise.

How does the attack unfold?

Reconnaissance

Attacker fingerprints internet-exposed OpenClaw instances via Shodan or HTTP scanning on known webhook path patterns to identify targets with Feishu webhook mode active.

AML.T0006

Initial Access

Attacker sends a forged HTTP POST to the Feishu webhook endpoint; without encryptKey configured, OpenClaw performs no cryptographic signature check and accepts the forged event as authentic.

AML.T0049

Execution

The accepted forged event triggers OpenClaw's tool execution stack, causing the AI agent to autonomously invoke registered tools — shell commands, file reads, API calls — on behalf of the attacker with no operator awareness.

AML.T0053

Impact

Agent executes attacker-controlled tool invocations leading to credential harvesting, data exfiltration to attacker infrastructure, or persistent access across all systems within the agent's permission scope.

AML.T0086

Reconnaissance

Attacker fingerprints internet-exposed OpenClaw instances via Shodan or HTTP scanning on known webhook path patterns to identify targets with Feishu webhook mode active.

AML.T0006

Initial Access

Attacker sends a forged HTTP POST to the Feishu webhook endpoint; without encryptKey configured, OpenClaw performs no cryptographic signature check and accepts the forged event as authentic.

AML.T0049

Execution

The accepted forged event triggers OpenClaw's tool execution stack, causing the AI agent to autonomously invoke registered tools — shell commands, file reads, API calls — on behalf of the attacker with no operator awareness.

AML.T0053

Impact

Agent executes attacker-controlled tool invocations leading to credential harvesting, data exfiltration to attacker infrastructure, or persistent access across all systems within the agent's permission scope.

AML.T0086

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.6 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 16% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C Low

I High

A Low

What should I do?

6 steps

Patch: Upgrade to OpenClaw 2026.3.12 or later, which enforces cryptographic event verification via encryptKey.
Workaround: If immediate patching is not feasible, configure encryptKey in all Feishu webhook integrations — this enables signature-based verification that rejects forged events regardless of verificationToken status.
Network isolation: Restrict the webhook endpoint to Feishu's published egress IP ranges via firewall or WAF rules; block all other inbound traffic to the webhook path.
Privilege audit: Review and revoke all OpenClaw agent tool permissions not strictly required for business function — apply least privilege to cap blast radius before patching is complete.
Detection: Alert on webhook endpoint requests originating outside Feishu IP ranges; monitor agent tool invocation logs for anomalous sequences, atypical volumes, or invocations outside normal business hours.
Inventory: Audit all OpenClaw instances across environments (dev, staging, prod) — non-production instances with broad permissions are equally exploitable.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0084.002 - Activation Triggers AML.T0108 - AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MS-2.5 - Manage AI risks through controls

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32974?

OpenClaw's Feishu webhook integration accepts forged events without cryptographic verification when only `verificationToken` is configured and `encryptKey` is absent — the common default deployment posture — allowing any unauthenticated network attacker to inject arbitrary webhook events. At CVSS 8.6 with no privileges or user interaction required, and ranking in the top 84th EPSS percentile, this is immediately reachable by unsophisticated actors against any internet-exposed instance. The critical risk is downstream: forged events trigger OpenClaw's tool execution stack autonomously, meaning the blast radius maps directly to whatever system permissions the agent holds — shell access, file systems, API credentials, or connected data pipelines. Patch immediately to version 2026.3.12; if patching is not immediately possible, configure `encryptKey` in the Feishu webhook settings and restrict the endpoint to Feishu's published IP ranges at the network perimeter.

Is CVE-2026-32974 actively exploited?

No confirmed active exploitation of CVE-2026-32974 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32974?

1. Patch: Upgrade to OpenClaw 2026.3.12 or later, which enforces cryptographic event verification via encryptKey. 2. Workaround: If immediate patching is not feasible, configure `encryptKey` in all Feishu webhook integrations — this enables signature-based verification that rejects forged events regardless of verificationToken status. 3. Network isolation: Restrict the webhook endpoint to Feishu's published egress IP ranges via firewall or WAF rules; block all other inbound traffic to the webhook path. 4. Privilege audit: Review and revoke all OpenClaw agent tool permissions not strictly required for business function — apply least privilege to cap blast radius before patching is complete. 5. Detection: Alert on webhook endpoint requests originating outside Feishu IP ranges; monitor agent tool invocation logs for anomalous sequences, atypical volumes, or invocations outside normal business hours. 6. Inventory: Audit all OpenClaw instances across environments (dev, staging, prod) — non-production instances with broad permissions are equally exploitable.

What systems are affected by CVE-2026-32974?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, webhook integrations, AI agent orchestration, multi-tool AI pipelines.

What is the CVSS score for CVE-2026-32974?

CVE-2026-32974 has a CVSS v3.1 base score of 8.6 (HIGH). The EPSS exploitation probability is 0.25%.

What is the AI security impact?

Affected AI Architectures

agent frameworkswebhook integrationsAI agent orchestrationmulti-tool AI pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0084.002 Activation Triggers

AML.T0108 AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MS-2.5

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forged Feishu events and trigger downstream tool execution by reaching the webhook endpoint.

Exploitation Scenario

An attacker uses Shodan or targeted HTTP fingerprinting to identify an internet-facing OpenClaw instance with a Feishu webhook endpoint active (discoverable via known webhook path conventions). Confirming the instance relies on verificationToken-only mode — inferable from documentation defaults or error response headers — the attacker crafts a forged HTTP POST body mimicking a legitimate Feishu event structure. Because `encryptKey` is absent, OpenClaw performs no cryptographic signature check, accepts the forged event as authentic, and routes it to the tool execution layer. The attacker encodes a payload instructing the agent to execute a reverse shell, read credential files from the agent's working directory, or exfiltrate data to an attacker-controlled endpoint. The agent executes autonomously with no operator visibility until post-compromise detection, and the attacker achieves persistent access to any resource within the agent's permission scope.

Weaknesses (CWE)

CWE-347 Improper Verification of Cryptographic Signature

CWE-347 — Improper Verification of Cryptographic Signature: The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Source: MITRE CWE corpus.