Skip to content
OpenAdvisories

Package · npm

@openclaw/bluebubbles

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-26316

    OpenClaw has BlueBubbles webhook auth bypass via loopback proxy trust

    OpenClaw is a personal AI assistant. Prior to 2026.2.13, the optional BlueBubbles iMessage channel plugin could accept webhook requests as authenticated based only on the TCP peer address being loopback (`127.0.0.1`, `::1`, `::ffff:127.0.0.1`) even when the c…

    OpenClaw OpenClaw @openclaw/bluebubbles openclaw npm