CVE-2026-26316

OpenClaw is a personal AI assistant. Prior to 2026.2.13, the optional BlueBubbles iMessage channel plugin could accept webhook requests as authenticated based only on the TCP peer address being loopback (`127.0.0.1`, `::1`, `::ffff:127.0.0.1`) even when the configured webhook secret was missing or incorrect. This does not affect the default iMessage integration unless BlueBubbles is installed and enabled. Version 2026.2.13 contains a patch. Other mitigations include setting a non-empty BlueBubbles webhook password and avoiding deployments where a public-facing reverse proxy forwards to a loopback-bound Gateway without strong upstream authentication.

• CWE-863

• https://github.com/openclaw/openclaw/commit/743f4b28495cdeb0d5bf76f6ebf4af01f6a02e5aPatch
• https://github.com/openclaw/openclaw/commit/f836c385ffc746cb954e8ee409f99d079bfdcd2fPatch
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.13Product, Release Notes
• https://github.com/openclaw/openclaw/security/advisories/GHSA-pchc-86f6-8758Patch, Vendor Advisory

Published

Feb 19, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-26310Envoy is a high-performance edge/middle/service proxy. Prior…7.5
• CVE-2026-26311Envoy is a high-performance edge/middle/service proxy. Prior…5.9
• CVE-2026-26312Stalwart is a mail and collaboration server. A denial-of-ser…6.5
• CVE-2026-26313go-ethereum (geth) is a golang execution layer implementatio…7.5
• CVE-2026-26314go-ethereum (geth) is a golang execution layer implementatio…7.5
• CVE-2026-26315go-ethereum (Geth) is a golang execution layer implementatio…7.5
• CVE-2026-26317OpenClaw is a personal AI assistant. Prior to 2026.2.14, bro…7.1
• CVE-2026-26318systeminformation is a System and OS information library for…8.8
• CVE-2026-26319OpenClaw is a personal AI assistant. Versions 2026.2.13 and …7.5
• CVE-2026-26320OpenClaw is a personal AI assistant. OpenClaw macOS desktop …6.5
• CVE-2026-26321OpenClaw is a personal AI assistant. Prior to OpenClaw versi…7.5
• CVE-2026-26322OpenClaw is a personal AI assistant. Prior to OpenClaw versi…7.6