CVE-2026-29613 Details

A vulnerability exists in OpenClaw versions prior to 2026.2.12 within the BlueBubbles optional plugin. The issue arises in the webhook handler, which authenticates requests based solely on loopback remote addresses. It fails to validate forwarding headers, allowing bypass of configured webhook passwords. This vulnerability is particularly concerning when the OpenClaw gateway is behind a reverse proxy, as it can enable unauthenticated remote attackers to inject arbitrary BlueBubbles message and reaction events by accessing the proxy endpoint.

Users should update to OpenClaw version 2026.2.12 or later, and ensure that a BlueBubbles webhook password is configured. Avoid exposing the gateway webhook endpoint publicly without authentication.