Skip to content
Submit incident
AII-1001-09263
ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.

OpenClaw BlueBubbles webhook auth bypass via loopback proxy trust

OpenClaw's BlueBubbles iMessage plugin accepted webhook requests based only on loopback TCP peer address, allowing unauthenticated injection of webhook events when exposed through a reverse proxy or via SSRF. The vulnerability was patched in version 2026.2.13.

14 February 2026 Β· OpenClaw Β· Security and cyberattacks
14 February 2026

Drafted by Raidu Incident Detection, an automated system.

AII-1001-09263View source β†—
Quick facts
Category
Security and cyberattacks
Source
github.com
Date
14 February 2026
Drafted by
Raidu Incident Detection

What happened

The BlueBubbles webhook handler in OpenClaw versions before 2026.2.13 accepted authenticated webhook requests based only on the TCP peer address being loopback (127.0.0.1, ::1, ::ffff:127.0.0.1), even when the configured webhook secret was missing or incorrect.

If a deployment exposed the BlueBubbles webhook endpoint through a same-host reverse proxy, or if an attacker could reach loopback via SSRF, an unauthenticated party could inject inbound webhook events into the agent pipeline.

Governance controls

The fix hardened BlueBubbles webhook auth behind reverse proxies by only accepting passwordless webhooks for direct localhost loopback requests; proxied requests now require a password.

Documentation was updated to advise users to always set a webhook password when exposing the gateway through a reverse proxy.

Classification

Category
Security and cyberattacks
Industry
Business processes and support services
Harm status
Potential harm
Intent
Unintentional
Timing
Post-deployment
AI systems
BlueBubbles

Sources and evidence

This record was researched and written by the Index, based on the following original reporting.

github.com
https://github.com/openclaw/openclaw/security/advisories/GHSA-pchc-86f6-8758
Aug 2026Claude AI agent discovers gym booking system vulnerability, cancels another user's reservationWell documentedSecurity and cyberattacksThe IndependentDiaspora Digital Media (DDM News) - Nigeria Breaking News, Africa and World News and Updates -The Indian Express+3Jun 2026Five malicious skills removed from OpenClaw ClawHub marketplaceConfirmedSecurity and cyberattacksUnit42Dark ReadingJun 2026OpenClaw AI agent vulnerabilities enable malicious skill packages to steal user dataUnder investigationSecurity and cyberattacksenglish.news.cnChina NewsApr 2026AI Agent Exploited Gym Booking API Authorization Flaw and Removed Member From WaitlistReportedSecurity and cyberattacksabc.net.auaffinda.comApr 2026Open-source AI agents expose security vulnerabilities in ChinaReportedSecurity and cyberattacksδΈœζ–Ήθ΄’ε―Œη½‘China News