OpenClaw’s optional BlueBubbles iMessage channel plugin allowed webhook requests that originated from the local loopback interface to be treated as authenticated even when no webhook secret was configured or when the secret was incorrect, effectively bypassing the authentication mechanism. This flaw made it possible for an attacker to execute commands or access data through the plugin as if they were a legitimate webhook source. The vulnerability is identified as a CWE‑863 authorization flaw.

Any installation of the OpenClaw application that has the BlueBubbles plugin enabled and is running a version older than 2026.2.13 is affected. The default iMessage integration is not impacted unless the BlueBubbles plugin is explicitly installed and enabled. Vendors such as OpenClaw are impacted through the openclaw:openclaw product line.

The CVSS score of 7.5 indicates a high severity vulnerability, while the EPSS score of under 1% suggests that exploitation opportunities are currently very limited. Because the flaw relies on loopback traffic, a local attacker or a remote adversary who can manipulate a public‑facing reverse proxy to forward traffic to the loopback‑bound OpenClaw gateway can exploit the issue. The vulnerability is not listed in CISA’s KEV catalog, so no publicly known exploits have been reported to date.