Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forged Feishu events and trigger downstream tool execution by reaching the webhook endpoint.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
[CVE-2026-32974: HIGH] Critical authentication bypass vulnerability discovered in OpenClaw before 2026.3.12. Attackers can inject forged Feishu events, triggering downstream tool execution. Upgrade now!#cve,CVE-2026-32974,#cybersecurity https://cvefind.com/CVE-2026-32974
Post summary
The post announces a critical authentication bypass in OpenClaw and urges users to upgrade to mitigate the risk.
CVE-2026-32974 OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowin… https://www.cve.org/CVERecord?id=CVE-2026-32974
Post summary
The entry lists CVE‑2026‑32974 as an authentication bypass issue in Feishu webhooks, but offers no code, exploit, or patch information.
🟠 CVE-2026-32974 - High OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged ev... https://www.thehackerwire.com/vulnerability/CVE-2026-32974/ https://t.co/2MuXczbAzd
Post summary
The announcement details a high‑severity authentication bypass in OpenClaw’s Feishu webhook mode due to missing encryptKey, but no patches, PoC, or active exploitation information are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |