OpenClaw before version 2026.3.12 contains an authentication bypass in Feishu webhook mode. When a verificationToken is configured without an encryptKey, an unauthenticated network attacker can forge Feishu events that the system accepts and forwards. The forged events can trigger configured downstream tools, effectively enabling the attacker to execute arbitrary commands on the host. This flaw compromises confidentiality, integrity, and availability of the affected system.

All installations of OpenClaw older than 2026.3.12 are affected. The product is the Node.js‑based OpenClaw service that processes Feishu webhook events.

The vulnerability scores 8.8 on CVSS, indicating high severity. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog, but the lack of required credentials and the controlled nature of the webhook endpoint makes exploitation relatively easy for an attacker with network access. The potential impact of arbitrary command execution is significant, necessitating prompt remediation.