Attack Chain

1. An attacker identifies an OpenClaw deployment using Feishu webhooks without a configured encryptKey.
2. The attacker crafts a malicious Feishu webhook request, bypassing signature validation due to the missing encryptKey.
3. The attacker sends the crafted webhook request to the OpenClaw endpoint.
4. OpenClaw processes the unauthenticated request, due to the missing encryptKey check, forwarding it to command dispatch.
5. Alternatively, the attacker crafts a malicious card-action callback with a blank callback token.
6. OpenClaw fails to reject the card-action callback with the blank token.
7. The unvalidated card-action is processed, triggering unintended commands within OpenClaw.
8. Successful exploitation allows the attacker to execute arbitrary commands within the context of the OpenClaw application.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access and command execution within the OpenClaw application. A vulnerable OpenClaw instance could be leveraged to perform actions such as data exfiltration, system compromise, or denial-of-service attacks. The lack of authentication and validation mechanisms exposes the OpenClaw deployment to significant risk, potentially affecting all users and systems managed by the platform.

Recommendation

• Upgrade OpenClaw to version 2026.4.15 or later to remediate the vulnerability. This version enforces validation of Feishu webhooks and card-action callbacks, preventing unauthenticated access (reference: Affected versions).
• Ensure that the encryptKey is properly configured for Feishu webhook integrations. The application will now refuse to start without it (reference: extensions/feishu/src/monitor.transport.ts).
• Deploy the Sigma rule provided below to detect attempts to exploit this vulnerability by monitoring for webhook requests without proper authentication or card-action callbacks with missing tokens.