Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in OpenClaw allows unauthenticated requests to execute arbitrary commands by bypassing signature verification. It occurs when Feishu webhook and card-action validation fail to properly check for missing configuration or empty tokens.
- Commands can be executed remotely.
- Integration services are a potential target.
- Existing access can be exploited.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this flaw by sending unauthenticated requests to the Feishu webhook or card-action endpoints. If the instance is misconfigured with a missing encryptKey or a blank callback token, these requests will bypass signature verification and replay protection. This allows the attacker to execute arbitrary commands on the affected system.
- Target Feishu webhook/card-action endpoints.
- Exploit misconfigurations in encryptKey/callback token.
- Bypass signature verification and replay protection.
Live Threat
Current exploitation, exposure, and threat context
This authentication bypass vulnerability in OpenClaw's Feishu integration allows unauthenticated attackers to execute arbitrary commands by exploiting misconfigurations like missing encryption keys and blank callback tokens. Attackers will likely target this because it provides a direct path to command execution on affected systems with minimal prerequisites.
- Exploits missing encryption keys.
- Exploits blank callback tokens.
- Allows arbitrary command execution.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize blocking unauthenticated requests to Feishu webhook and card-action endpoints immediately, as this critical vulnerability allows arbitrary command execution. Investigate logs for any signs of exploitation and inventory all affected OpenClaw services to assess potential exposure. If OpenClaw has not been patched to version 2026.4.15 or later, consider taking affected services offline or isolating them to prevent further compromise.
- Block unauthenticated webhook traffic.
- Inventory and isolate affected services.
- Patch OpenClaw to 2026.4.15.
