CVE-2026-8305

OpenClaw bluebubbles Webhook monitor.ts handleBlueBubblesWebhookRequest improper authentication

State: Published
Severity: 6.9 Medium
Published: May 11, 2026
Updated: May 11, 2026
Reserved: May 11, 2026

Description

A vulnerability was detected in OpenClaw up to 2026.1.24. The impacted element is the function handleBlueBubblesWebhookRequest of the file extensions/bluebubbles/src/monitor.ts of the component bluebubbles Webhook. Performing a manipulation results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 2026.2.12 is sufficient to resolve this issue. The patch is named a6653be0265f1f02b9de46c06f52ea7c81a836e6. The affected component should be upgraded.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
OpenClawn/a	2026.1.0Affected 2026.1.1Affected 2026.1.2Affected 2026.1.3Affected 2026.1.4Affected 2026.1.5Affected 2026.1.6Affected 2026.1.7Affected 2026.1.8Affected 2026.1.9Affected 2026.1.10Affected 2026.1.11Affected 2026.1.12Affected 2026.1.13Affected 2026.1.14Affected 2026.1.15Affected 2026.1.16Affected 2026.1.17Affected 2026.1.18Affected 2026.1.19Affected 2026.1.20Affected 2026.1.21Affected 2026.1.22Affected 2026.1.23Affected 2026.1.24Affected and 1 more version

Product

Versions

OpenClawn/a

2026.1.0Affected
2026.1.1Affected
2026.1.2Affected
2026.1.3Affected
2026.1.4Affected
2026.1.5Affected
2026.1.6Affected
2026.1.7Affected
2026.1.8Affected
2026.1.9Affected
2026.1.10Affected
2026.1.11Affected
2026.1.12Affected
2026.1.13Affected
2026.1.14Affected
2026.1.15Affected
2026.1.16Affected
2026.1.17Affected
2026.1.18Affected
2026.1.19Affected
2026.1.20Affected
2026.1.21Affected
2026.1.22Affected
2026.1.23Affected
2026.1.24Affected
and 1 more version

References

VDB-362590 | OpenClaw bluebubbles Webhook monitor.ts handleBlueBubblesWebhookRequest improper authenticationvdb-entrytechnical-description
VDB-362590 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #809371 | OpenClaw (formally ClawdBot) openclaw 2026.1.24 Authentication Bypass Issuesthird-party-advisory
https://github.com/openclaw/openclaw/issues/13786issue-tracking
https://github.com/openclaw/openclaw/pull/13787issue-trackingpatch
https://github.com/Dave-gilmore-aus/security-advisories/blob/main/ClawdBot(aka%20OpenClaw)-Auth-Bypass-SSRFexploit
https://github.com/openclaw/openclaw/commit/a6653be0265f1f02b9de46c06f52ea7c81a836e6patch
https://github.com/openclaw/openclaw/releases/tag/v2026.2.12patch
https://github.com/openclaw/openclaw/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.