CVE-2026-26316
Description
OpenClaw is a personal AI assistant. Prior to 2026.2.13, the optional BlueBubbles iMessage channel plugin could accept webhook requests as authenticated based only on the TCP peer address being loopback (127.0.0.1, ::1, ::ffff:127.0.0.1) even when the configured webhook secret was missing or incorrect. This does not affect the default iMessage integration unless BlueBubbles is installed and enabled. Version 2026.2.13 contains a patch. Other mitigations include setting a non-empty BlueBubbles webhook password and avoiding deployments where a public-facing reverse proxy forwards to a loopback-bound Gateway without strong upstream authentication.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
openclawnpm | < 2026.2.13 | 2026.2.13 |
@openclaw/bluebubblesnpm | < 2026.2.13 | 2026.2.13 |
Affected products
5- ghsa-coords2 versions
< 2026.2.13+ 1 more
- (no CPE)range: < 2026.2.13
- (no CPE)range: < 2026.2.13
- openclaw/@openclaw/bluebubblesv5Range: < 2026.2.13
Patches
Vulnerability mechanics
References
7- github.com/openclaw/openclaw/commit/743f4b28495cdeb0d5bf76f6ebf4af01f6a02e5anvdPatchWEB
- github.com/openclaw/openclaw/commit/f836c385ffc746cb954e8ee409f99d079bfdcd2fnvdPatchWEB
- github.com/openclaw/openclaw/security/advisories/GHSA-pchc-86f6-8758nvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-pchc-86f6-8758ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-26316ghsaADVISORY
- github.com/openclaw/openclaw/releases/tag/v2026.2.12ghsaWEB
- github.com/openclaw/openclaw/releases/tag/v2026.2.13nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.