CVE-2026-35640

EPSS 0.13%

OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation

發布日:2026/3/29修改日:2026/4/10

描述

## Summary Feishu webhook reads and parses unauthenticated request bodies before signature validation ## Affected Packages / Versions - Package: `openclaw` - Affected versions: `<= 2026.3.24` - First patched version: `2026.3.25` - Latest published npm version at verification time: `2026.3.24` ## Details Feishu webhook handling previously parsed JSON before signature validation, which let unauthenticated callers force full JSON parsing work before rejection. Commit `5e8cb22176e9235e224be0bc530699261eb60e53` reads the raw request body, validates the signature first, and only then parses JSON. Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `5e8cb22176e9235e224be0bc530699261eb60e53`. ## Fix Commit(s) - `5e8cb22176e9235e224be0bc530699261eb60e53`

受影響套件(1)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 4.0—CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

參考連結(5)