The BlueBubbles webhook handler in OpenClaw, for versions earlier than 2026.2.21, includes a passwordless fallback authentication path. When a webhook request is routed through a loopback or reverse‑proxy path, the handler bypasses credential checks, enabling unauthenticated webhook events to reach the BlueBubbles plugin. Attackers can exploit this by sending such requests, thereby triggering plugin logic that normally requires authentication. This flaw can lead to the execution of privileged code that would otherwise be restricted to authenticated calls.

All OpenClaw installations running a Node.js‑based version earlier than 2026.2.21 that include the BlueBubbles plugin are vulnerable. The vulnerability applies to environments where the application trusts requests from the local host or a reverse‑proxy, such as reverse‑proxy or local routing configurations.

The assigned CVSS score of 6.3 indicates moderate severity. The EPSS score of 0.00084 shows a very low likelihood of exploitation, and the issue is not listed in the CISA KEV catalog, implying limited known exploitation. The likely attack vector requires the attacker to be able to reach the OpenClaw server through a misconfigured reverse‑proxy or local routing path that the application accepts without authentication, allowing the delivery of an unauthenticated webhook event to the BlueBubbles endpoint.