GHSA-g353-mgv3-8pcj

Suggest an improvement
Source
https://github.com/advisories/GHSA-g353-mgv3-8pcj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-g353-mgv3-8pcj/GHSA-g353-mgv3-8pcj.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-g353-mgv3-8pcj
Aliases
Downstream
Published
2026-03-13T20:55:34Z
Modified
2026-04-06T22:56:23Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L CVSS Calculator
Summary
OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured
Details

Summary

Feishu webhook mode allowed deployments that configured only verificationToken without encryptKey. In that state, forged inbound events could be accepted because the weaker configuration did not provide the required cryptographic verification boundary.

Impact

An unauthenticated network attacker who could reach the webhook endpoint could inject forged Feishu events, impersonate senders, and potentially trigger downstream tool execution subject to the local agent policy.

Affected versions

openclaw <= 2026.3.11

Patch

Fixed in openclaw 2026.3.12. Feishu webhook mode now fails closed unless encryptKey is configured, and the webhook transport rejects missing or invalid signatures before dispatch. Update to 2026.3.12 or later and configure encryptKey for webhook deployments.

Database specific 
{
    "cwe_ids": [
        "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-13T20:55:34Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2026.3.12

Database specific

last_known_affected_version_range 
"<= 2026.3.11"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-g353-mgv3-8pcj/GHSA-g353-mgv3-8pcj.json"