CVE-2026-32974 is a high severity authentication bypass in OpenClaw, scored CVSS 8.6. In Feishu webhook mode with only a verification token configured, forged events were accepted and could trigger tool execution. Upgrade to OpenClaw 2026.3.12 and configure an encryptKey. The same release now refuses webhook mode when that key is missing.
What's affected
The GitHub advisory says OpenClaw 2026.3.11 and below are affected, and 2026.3.12 is fixed. The NVD record words it as before 2026.3.12.
The condition is Feishu webhook mode configured with a verificationToken but no encryptKey. The advisory says the weaker setup did not give the cryptographic verification the transport needed.
How to check if you're exposed
Check the version:
npm ls openclaw
Then check the Feishu channel configuration for webhook mode. If you have a verification token but no encryption key, you are in the affected setup.
Check whether the webhook endpoint is reachable from the internet, since the record describes an unauthenticated network attacker.
What to do now
- Upgrade OpenClaw to 2026.3.12 or later.
- Set an encryptKey for Feishu webhook deployments. The fixed version refuses webhook mode without one.
- Review the tools your agents can run from webhook events and reduce that list to what is needed.
- Check logs for Feishu events from senders you do not recognize.
Why it matters
The class is CWE-347, improper verification of a cryptographic signature. A shared token in a request is not a signature. Anyone who learns or guesses it can replay it, while a signed payload fails unless the sender holds the key.
Webhooks that can start agent actions deserve extra care, because a forged message becomes real work done with real permissions. The fix makes the transport fail closed and reject missing or invalid signatures before dispatch. The record's KEV flag is false.
Quick check
What does fail closed mean here?
Without an encryptKey, webhook mode is refused rather than running with weaker checks.
Sources
Last reviewed: 19 October 2026.
