CVE-2026-32974
OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured
Impact
### Summary Feishu webhook mode allowed deployments that configured only `verificationToken` without `encryptKey`. In that state, forged inbound events could be accepted because the weaker configuration did not provide the required cryptographic verification boundary. ### Impact An unauthenticated network attacker who could reach the webhook endpoint could inject forged Feishu events, impersonate senders, and potentially trigger downstream tool execution subject to the local agent policy. ### Affected versions `openclaw` `<= 2026.3.11` ### Patch Fixed in `openclaw` `2026.3.12`. Feishu webhook mode now fails closed unless `encryptKey` is configured, and the webhook transport rejects missing or invalid signatures before dispatch. Update to `2026.3.12` or later and configure `encryptKey` for webhook deployments.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | openclaw | <= 2026.3.11 | 2026.3.12 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openclaw | Openclaw | before 2026.3.12 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/openclaw/openclaw/security/advisories/GHSA-g353-mgv3-8pcj
- https://www.vulncheck.com/advisories/openclaw-forged-event-injection-via-feishu-webhook-verification-token
- https://github.com/advisories/GHSA-g353-mgv3-8pcj
- https://github.com/openclaw/openclaw/pull/44087
- https://github.com/openclaw/openclaw/commit/7844bc89a1612800810617c823eb0c76ef945804
- https://github.com/openclaw/openclaw/releases/tag/v2026.3.12
- https://nvd.nist.gov/vuln/detail/CVE-2026-32974