CVE-2026-44109 — AI Deep Analysis Summary

🚨 **Essence**: OpenClaw < 2026.4.15 has a critical **Authentication Bypass** in Feishu Webhooks & Card Actions. 🛑 **Consequences**: Unauthenticated requests reach the command scheduler.…

🛡️ **Root Cause**: **CWE-1188** (Insecure Configuration). The system defaults to **allowing** requests (fail-open) instead of rejecting them when `encryptKey` is missing or callback tokens are empty.…

📦 **Affected**: **OpenClaw** versions **before 2026.4.15**. Specifically impacts the **Feishu Webhook** integration and **Card Action** validation modules. If you are running an older version, you are vulnerable.

💀 **Attacker Capabilities**: With **No Privileges** required (PR:N), hackers can bypass auth checks. They can execute **Arbitrary Commands** on the system.…

⚡ **Exploitation Threshold**: **LOW**. ⚠️ No authentication (PR:N) needed. Low complexity (AC:L). No user interaction (UI:N) required.…

🔍 **Public Exploit**: **No PoC** currently listed in the data. However, the vulnerability logic (fail-open on missing keys) is straightforward.…

🔎 **Self-Check**: 1. Check your OpenClaw version (must be < 2026.4.15). 2. Verify if `encryptKey` is configured for Feishu Webhooks. 3. Ensure callback tokens are **not empty**. 4.…

✅ **Official Fix**: **YES**. Patched in version **2026.4.15** and later. 📝 **Patch Commit**: [c8003f1b](https://github.com/openclaw/openclaw/commit/c8003f1b33ed2924be5f62131bd28742c5a41aae).…

🛠️ **Workaround (No Patch)**: If you cannot upgrade immediately: 1. **Strictly configure** the `encryptKey`. 2. Ensure **non-empty** callback tokens are set. 3.…

🔥 **Urgency**: **CRITICAL**. 🚨 CVSS Score is **High** (likely 9.8+). Remote Code Execution (RCE) potential with no auth required. **Action**: Upgrade to **2026.4.15+** immediately.…