CVE-2026-29613
1 advisory.
npm/openclaw CVE-2026-29613: medium 5.9, EPSS 0.64%
OpenClaw has a webhook auth bypass when gateway is behind a reverse proxy (loopback remoteAddress trust)
Action: Upgrade openclaw to 2026.2.12 or later.
npm i openclaw@2026.2.12Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2026.2.12 | - |
Fixed versions
| 2026.2.12 |
Sources
- osv: GHSA-xc7w-v5x6-cc87
- https://github.com/openclaw/openclaw/security/advisories/GHSA-xc7w-v5x6-cc87
- https://nvd.nist.gov/vuln/detail/CVE-2026-29613
- https://github.com/openclaw/openclaw/commit/743f4b28495cdeb0d5bf76f6ebf4af01f6a02e5a
- https://github.com/openclaw/openclaw/commit/f836c385ffc746cb954e8ee409f99d079bfdcd2f
- https://github.com/openclaw/openclaw
- https://github.com/openclaw/openclaw/releases/tag/v2026.2.12
- https://www.vulncheck.com/advisories/openclaw-webhook-authentication-bypass-via-loopback-remoteaddress-trust
CVE-2026-29613 · published · modified · JSON