CVE-2026-44109 Details

An authentication bypass vulnerability has been identified in OpenClaw versions prior to 2026.4.15. This vulnerability exists in the Feishu webhook and card-action validation processes, allowing unauthenticated requests to bypass signature verification and replay protection, ultimately reaching the command dispatch system. The issue arises because the Feishu integration can accept requests without a proper 'encryptKey' and allows blank callback tokens to be used, creating a fail-open scenario. As a result, attackers can exploit this vulnerability to execute arbitrary commands on the affected system.

Users can upgrade to OpenClaw version 2026.4.15 or later, which addresses this vulnerability by ensuring that the Feishu webhook requires a valid 'encryptKey' and rejects blank callback tokens before processing card-action events.