Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenClaw < 2026.3.12 - Forged Event Injection via Feishu Webhook Verification Token
Vulnerability Description
OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forged Feishu events and trigger downstream tool execution by reaching the webhook endpoint.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Vulnerability Type
密码学签名的验证不恰当
Vulnerability Title
OpenClaw 数据伪造问题漏洞
Vulnerability Description
OpenClaw是OpenClaw开源的一个智能人工助理。 OpenClaw 2026.3.12之前版本存在数据伪造问题漏洞，该漏洞源于Feishu webhook模式存在身份验证绕过问题，当仅配置verificationToken而未配置encryptKey时，可能导致未经身份验证的网络攻击者注入伪造的Feishu事件并触发下游工具执行。
CVSS Information
N/A
Vulnerability Type
N/A