Количество 3
Количество 3
CVE-2026-29613
OpenClaw versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles (optional plugin) webhook handler in which it authenticates requests based solely on loopback remoteAddress without validating forwarding headers, allowing bypass of configured webhook passwords. When the gateway operates behind a reverse proxy, unauthenticated remote attackers can inject arbitrary BlueBubbles message and reaction events by reaching the proxy endpoint.
GHSA-xc7w-v5x6-cc87
OpenClaw has a webhook auth bypass when gateway is behind a reverse proxy (loopback remoteAddress trust)
BDU:2026-06169
Уязвимость плагина BlueBubbles ИИ-агента OpenClaw (ранее - ClawdBot или MoltBot), позволяющая нарушителю обойти существующие механизмы безопасности
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-29613 OpenClaw versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles (optional plugin) webhook handler in which it authenticates requests based solely on loopback remoteAddress without validating forwarding headers, allowing bypass of configured webhook passwords. When the gateway operates behind a reverse proxy, unauthenticated remote attackers can inject arbitrary BlueBubbles message and reaction events by reaching the proxy endpoint. | CVSS3: 5.9 | 0% Низкий | 5 месяцев назад |
| GHSA-xc7w-v5x6-cc87 OpenClaw has a webhook auth bypass when gateway is behind a reverse proxy (loopback remoteAddress trust) | CVSS3: 5.9 | 0% Низкий | 6 месяцев назад |
 | BDU:2026-06169 Уязвимость плагина BlueBubbles ИИ-агента OpenClaw (ранее - ClawdBot или MoltBot), позволяющая нарушителю обойти существующие механизмы безопасности | CVSS3: 5.9 | 0% Низкий | 6 месяцев назад |
Уязвимостей на страницу