OpenClaw Authentication Bypass Vulnerability in Feishu Webhook Mode

An authentication bypass vulnerability has been identified in OpenClaw versions through 2026.3.11. The issue arises in Feishu webhook mode when only the verificationToken is set, without an encryptKey. This configuration flaw allows unauthenticated network attackers to send forged Feishu events to the webhook endpoint, potentially triggering downstream tool executions, depending on the local agent policy.

Impact

Exploitation of this vulnerability allows for the injection of forged Feishu events into the system, impersonating legitimate senders and possibly executing unauthorized actions through connected tools.

Remediation

Users can update to OpenClaw version 2026.3.12 or later, and should configure the encryptKey for webhook deployments to ensure proper event verification.