Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · OpenClaw

CVE-2026-35640: OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation

mediumCVSS 4.0 6.9GHSA-3h52-cx59-c456

Summary Feishu webhook reads and parses unauthenticated request bodies before signature validation Affected Packages / Versions - Package: openclaw - Affected versions: <= 2026.3.24 - First patched version: 2026.3.25 - Latest published npm version at verification time: 2026.3.24 Details Feishu webhook handling previously parsed JSON before signature validation, which let unauthenticated callers force full JSON…

Published Mar 29, 2026 · Updated Apr 10, 2026

Affected packages

openclaw

Ecosystem
npm
Affected
< 2026.3.28
Fixed in
2026.3.28
Check
npm ls openclaw

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

Feishu webhook reads and parses unauthenticated request bodies before signature validation

Affected Packages / Versions

  • Package: openclaw
  • Affected versions: <= 2026.3.24
  • First patched version: 2026.3.25
  • Latest published npm version at verification time: 2026.3.24

Details

Feishu webhook handling previously parsed JSON before signature validation, which let unauthenticated callers force full JSON parsing work before rejection. Commit 5e8cb22176e9235e224be0bc530699261eb60e53 reads the raw request body, validates the signature first, and only then parses JSON.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 5e8cb22176e9235e224be0bc530699261eb60e53.

Fix Commit(s)

  • 5e8cb22176e9235e224be0bc530699261eb60e53

Credited to tdjackey.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More OpenClaw vulnerabilities

All OpenClaw entries