AI agent vulnerability · OpenClaw

CVE-2026-26316: OpenClaw BlueBubbles webhook auth bypass via loopback proxy trust

highCVSS 3.1 7.5GHSA-pchc-86f6-8758

Summary In affected versions, the optional BlueBubbles iMessage channel plugin could accept webhook requests as authenticated based only on the TCP peer address being loopback (127.0.0.1, ::1, ::ffff:127.0.0.1) even when the configured webhook secret was missing or incorrect. This does not affect the default iMessage integration unless BlueBubbles is installed and enabled.

Published Feb 17, 2026 · Updated Feb 20, 2026

Affected packages

openclaw

Ecosystem: npm
Affected: < 2026.2.13
Fixed in: 2026.2.13
Check: npm ls openclaw

@openclaw/bluebubbles

Ecosystem: npm
Affected: < 2026.2.13
Fixed in: 2026.2.13
Check: npm ls @openclaw/bluebubbles

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

In affected versions, the optional BlueBubbles iMessage channel plugin could accept webhook requests as authenticated based only on the TCP peer address being loopback (127.0.0.1, ::1, ::ffff:127.0.0.1) even when the configured webhook secret was missing or incorrect. This does not affect the default iMessage integration unless BlueBubbles is installed and enabled.

Affected Packages / Versions

npm: openclaw < 2026.2.13
npm: @openclaw/bluebubbles < 2026.2.13

Details

If a deployment exposes the BlueBubbles webhook endpoint through a same-host reverse proxy (or an attacker can reach loopback via SSRF), an unauthenticated party may be able to inject inbound webhook events into the agent pipeline.

Fix Commit(s)

f836c385ffc746cb954e8ee409f99d079bfdcd2f
743f4b28495cdeb0d5bf76f6ebf4af01f6a02e5a (defense-in-depth)

Mitigations

Set a non-empty BlueBubbles webhook password.
Avoid deployments where a public-facing reverse proxy forwards to a loopback-bound Gateway without strong upstream authentication.

Thanks @MegaManSec (https://joshua.hu) of AISLE Research Team for reporting.

Credited to MegaManSec.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries