{"action":"Upgrade openclaw to 2026.2.21 or later.","affected":[{"fixed":"2026.2.21","introduced":"0"}],"component":"openclaw","cve_ids":["CVE-2026-32896"],"ecosystem":"npm","epss":0.00254,"exploited":false,"fixed_versions":["2026.2.21"],"ghsa_id":"GHSA-5mx2-2mgw-x8rm","id":"tcs_01M5KF47RD0F18AZQN2P72CZM8","modified_at":"2026-03-30T14:11:33.153599Z","published_at":"2026-03-03T21:35:56Z","references":["https://osv.dev/vulnerability/GHSA-5mx2-2mgw-x8rm","https://github.com/openclaw/openclaw/security/advisories/GHSA-5mx2-2mgw-x8rm","https://nvd.nist.gov/vuln/detail/CVE-2026-32896","https://github.com/openclaw/openclaw/commit/283029bdea23164ab7482b320cb420d1b90df806","https://github.com/openclaw/openclaw/commit/6b2f2811dc623e5faaf2f76afaa9279637174590","https://github.com/openclaw/openclaw","https://www.vulncheck.com/advisories/openclaw-unauthenticated-webhook-access-via-passwordless-fallback-in-bluebubbles-plugin"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-5mx2-2mgw-x8rm","url":"https://osv.dev/vulnerability/GHSA-5mx2-2mgw-x8rm"}],"summary":"OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)"}