s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

CVE-2026-26316

📛 CVE Title

OpenClaw has BlueBubbles webhook auth bypass via loopback proxy trust

⬇ Download JSON ⚠ View as Threat

Description

OpenClaw is a personal AI assistant. Prior to 2026.2.13, the optional BlueBubbles iMessage channel plugin could accept webhook requests as authenticated based only on the TCP peer address being loopback (`127.0.0.1`, `::1`, `::ffff:127.0.0.1`) even when the configured webhook secret was missing or incorrect. This does not affect the default iMessage integration unless BlueBubbles is installed and enabled. Version 2026.2.13 contains a patch. Other mitigations include setting a non-empty BlueBubbles webhook password and avoiding deployments where a public-facing reverse proxy forwards to a loopback-bound Gateway without strong upstream authentication.

Overview

State
PUBLISHED
Assigner (CNA)
GitHub_M
CVSS severity
HIGH
CVSS score
CVSS 7.5 / 10 7.5 7.5 / 10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Effective score
7.5 / 10 HIGH source: CNA overview
CWE(s)
CWE-863
Reserved
2026-02-13
Published
2026-02-19 22:28 UTC
Last updated
2026-02-20 16:41 UTC
Source
https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/26xxx/CVE-2026-26316.json
Linked Threat
CVE-2026-26316 — OpenClaw has BlueBubbles webhook auth bypass via loopback proxy trust

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published
2026-02-19 22:16:47 UTC
NVD last modified
2026-02-24 19:59:36 UTC
NVD CVSS v3.1
CVSS 7.5 / 10 7.5 7.5 / 10 HIGH source: security-advisories@github.com
NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Exploitability subscore
3.9 / 10
Impact subscore
3.6 / 10
EPSS score
0.0008 (probability of exploitation in next 30 days)
EPSS percentile
24.12% vs all CVEs — higher = more likely to be exploited, as of 2026-05-25

NVD / KEV / EPSS data refreshed 2026-05-25 18:11 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID
EUVD-2026-8432
Assigner
GitHub_M
Published
Feb 19, 2026, 9:28:33 PM
Updated
Feb 20, 2026, 3:41:50 PM
EUVD base score (CVSS 3.1)
7.5 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EUVD-reported EPSS
0.0800
Vendors
OpenClaw
Products
OpenClaw (< 2026.2.13)
OpenClaw (< 2026.2.13)
@openclaw/bluebubbles (< 2026.2.13)
@openclaw/bluebubbles (< 2026.2.13)
Aliases
GHSA-pchc-86f6-8758

ENISA description: OpenClaw is a personal AI assistant. Prior to 2026.2.13, the optional BlueBubbles iMessage channel plugin could accept webhook requests as authenticated based only on the TCP peer address being loopback (`127.0.0.1`, `::1`, `::ffff:127.0.0.1`) even when the configured webhook secret was missing or incorrect. This does not affect the default iMessage integration unless BlueBubbles is installed and enabled. Version 2026.2.13 contains a patch. Other mitigations include setting a non-empty BlueBubbles webhook password and avoiding deployments where a public-facing reverse proxy forwards to a loopback-bound Gateway without strong upstream authentication.

EUVD references (4)

Affected products (2)
VendorProductVersionsPlatforms
openclaw openclaw < 2026.2.13 (affected) —
openclaw @openclaw/bluebubbles < 2026.2.13 (affected) —

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

  • cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

MITRE references (4) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

Indicators (1)

IOCs linked to the auto-promoted Threat row.

TypeValueVirusTotalAttached
ipv4 127.0.0.1 2026-05-22 03:12 UTC)">malicious
2026-05-18 21:18 UTC

Flagged vendors

    Remediations (19)

    Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

    • Security Update Guide - Microsoft
      web:portal.msrc.microsoft.com

      The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

      2026-05-22 16:15 UTC
    • April 2026 Patch Tuesday: Updates and Analysis | CrowdStrike
      web:www.crowdstrike.com

      Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.

      2026-05-22 16:15 UTC
    • Microsoft Patch Tuesday April 2026 - 168 Vulnerabilities Fixed ...
      web:cybersecuritynews.com

      Microsoft has released its April 2026 Patch Tuesday security update, addressing 168 vulnerabilities across its product portfolio including one actively exploited zero-day and one publicly disclosed flaw that organizations must prioritize immediately.

      2026-05-22 16:15 UTC
    • Microsoft fixes 167 security flaws in April, second biggest Patch ...
      web:www.pcworld.com

      This month's Patch Tuesday includes an actively exploited Office zero-day vulnerability and several critical RCE bugs in Windows and Remote Desktop.

      2026-05-22 16:15 UTC
    • Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days
      web:www.bleepingcomputer.com

      Today is Microsoft's April 2026 Patch Tuesday with security updates for 167 flaws, including 2 zero-day vulnerabilities.

      2026-05-22 16:15 UTC
    • Microsoft Issues Massive Windows Patch for 160+ Bugs ... - TechRepublic
      web:www.techrepublic.com

      Microsoft's April 2026 Patch Tuesday fixes 165 vulnerabilities, including two zero-days, in one of the company's largest monthly security updates.

      2026-05-22 16:15 UTC
    • Nvd - Cve-2026-20631
      web:nvd.nist.gov

      An official website of the United States government Here's how you know

      2026-05-22 16:15 UTC
    • Windows 11 April 2026 Update tested: What's new, improved and fixed
      web:www.windowslatest.com

      Windows 11 April 2026 update adds Narrator Copilot support, faster Settings, File Explorer fixes, and key security improvements.

      2026-05-22 16:15 UTC
    • Microsoft and Adobe Patch Tuesday, April 2026 Security Update Review
      web:blog.qualys.com

      With Qualys Policy Audit's out-of-the-box mitigation or Compensatory Controls, which reduce the risk of a vulnerability being exploited because the remediation ( fix / patch ) cannot be done immediately, these security controls are not recommended by any industry standards, such as CIS and DISA-STIG.

      2026-05-22 16:15 UTC
    • I tested Windows 11 March 2026 Updates: Everything new ... - Windows Latest
      web:www.windowslatest.com

      Windows 11 March 2026 Patch Tuesday update adds Emoji 16.0, Sysmon, network speed test, reliability improvements, and security fixes.

      2026-05-22 02:52 UTC
    • Patch Tuesday May 2026: Security Updates & CVE Analysis
      web:zecurit.com

      Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

      2026-05-22 02:52 UTC
    • Microsoft and Adobe Patch Tuesday, May 2026 Security Update Review
      web:blog.qualys.com

      May 2026's Patch Tuesday arrives with Microsoft addressing a fresh set of vulnerabilities across its ecosystem, reinforcing the ongoing need for timely patching in an increasingly threat-heavy…

      2026-05-22 02:52 UTC
    • Microsoft Patch Tuesday March 2026 - 78 Vulnerabilities Fixed ...
      web:cybersecuritynews.com

      Microsoft released its March 2026 Patch Tuesday security update on March 10, 2026 , addressing 78 vulnerabilities across Windows, Microsoft Office, Azure, SQL Server, and .NET. The update includes one actively exploited zero-day vulnerability and multiple Critical-rated flaws demanding immediate attention from security teams. The most urgent fix this month is CVE - 2026 -21262, the sole zero-day ...

      2026-05-22 02:52 UTC
    • Security Update Guide - Microsoft
      web:msrc.microsoft.com

      The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

      2026-05-22 02:52 UTC
    • April 2026 Patch Tuesday: 163 CVEs, critical issues, and the unpatched ...
      web:windowsforum.com

      Microsoft's April 2026 Patch Tuesday lands as one of the busiest security releases in recent memory, with 163 vulnerabilities closed across Windows, Office, SharePoint, .NET, Visual Studio, Dynamics 365, SQL Server, Azure, Defender Antimalware Platform, PowerShell, and related services. The...

      2026-05-22 02:52 UTC
    • Microsoft March 2026 Patch Tuesday fixes 2 zero-days, 79 flaws
      web:www.bleepingcomputer.com

      Today is Microsoft's March 2026 Patch Tuesday with security updates for 79 flaws, including 2 publicly disclosed zero-day vulnerabilities.

      2026-05-22 02:52 UTC
    • Critical Patches Issued for Microsoft Products, April 14, 2026
      web:www.cisecurity.org

      <p>Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or ...

      2026-05-22 02:52 UTC
    • Oracle Critical Patch Update Advisory - April 2026
      web:www.oracle.com

      This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

      2026-05-22 02:52 UTC
    • Patch Tuesday - March 2026 - Rapid7
      web:www.rapid7.com

      Microsoft is publishing 77 vulnerabilities this Patch Tuesday, including two publicly disclosed zero-day vulnerabilities.

      2026-05-22 02:52 UTC

    AI Forensic Analysis

    Only Available for Registered Users. Sign in to view.

    Raw JSON

    The full cvelistV5 record. Download as CVE-2026-26316.json.

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-26316",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-20T15:32:08.946229Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-20T15:41:50.888Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openclaw",
          "vendor": "openclaw",
          "versions": [
            {
              "status": "affected",
              "version": "< 2026.2.13"
            }
          ]
        },
        {
          "product": "@openclaw/bluebubbles",
          "vendor": "openclaw",
          "versions": [
            {
              "status": "affected",
              "version": "< 2026.2.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenClaw is a personal AI assistant. Prior to 2026.2.13, the optional BlueBubbles iMessage channel plugin could accept webhook requests as authenticated based only on the TCP peer address being loopback (`127.0.0.1`, `::1`, `::ffff:127.0.0.1`) even when the configured webhook secret was missing or incorrect. This does not affect the default iMessage integration unless BlueBubbles is installed and enabled. Version 2026.2.13 contains a patch. Other mitigations include setting a non-empty BlueBubbles webhook password and avoiding deployments where a public-facing reverse proxy forwards to a loopback-bound Gateway without strong upstream authentication."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-19T21:28:33.454Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openclaw/openclaw/security/advisories/GHSA-pchc-86f6-8758",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-pchc-86f6-8758"
        },
        {
          "name": "https://github.com/openclaw/openclaw/commit/743f4b28495cdeb0d5bf76f6ebf4af01f6a02e5a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openclaw/openclaw/commit/743f4b28495cdeb0d5bf76f6ebf4af01f6a02e5a"
        },
        {
          "name": "https://github.com/openclaw/openclaw/commit/f836c385ffc746cb954e8ee409f99d079bfdcd2f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openclaw/openclaw/commit/f836c385ffc746cb954e8ee409f99d079bfdcd2f"
        },
        {
          "name": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.13",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.13"
        }
      ],
      "source": {
        "advisory": "GHSA-pchc-86f6-8758",
        "discovery": "UNKNOWN"
      },
      "title": "OpenClaw has BlueBubbles webhook auth bypass via loopback proxy trust"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-26316",
    "datePublished": "2026-02-19T21:28:33.454Z",
    "dateReserved": "2026-02-13T16:27:51.807Z",
    "dateUpdated": "2026-02-20T15:41:50.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}