The BlueBubbles plugin in OpenClaw processes webhook events without requiring credentials when the request is routed through a loopback or reverse‑proxy path. This passwordless fallback allows an attacker to trigger privileged plugin logic by sending an unauthenticated webhook request, potentially executing code that is otherwise restricted to authenticated calls.

All OpenClaw installations running a Node.js‑based version earlier than 2026.2.21 that include the BlueBubbles plugin are vulnerable. The vulnerability applies to environments where the application trusts requests from the local host or a reverse‑proxy, such as reverse‑proxy or local routing configurations.

The assigned CVSS score of 6.3 indicates moderate severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, implying limited known exploitation. The likely attack vector requires the attacker to be able to reach the OpenClaw server through a misconfigured reverse‑proxy or local routing path that the application accepts without authentication, allowing the delivery of an unauthenticated webhook event to the BlueBubbles endpoint.