Security Digest: February 17, 2026 - 11 Critical Vulnerabilities

Today, we have discovered 11 critical vulnerabilities across multiple platforms, including OpenClaw and fast-xml-parser. Immediate action is required to prevent potential exploits that could lead to unauthorized access.

· 7 min read

Executive Summary

Today, we have discovered 11 critical vulnerabilities across multiple platforms, including OpenClaw, fast-xml-parser, and Rust libraries. Immediate action is required to prevent potential exploits that could lead to unauthorized access, data exfiltration, and service disruptions.

Critical Vulnerabilities

  • CVE-2026-26322: OpenClaw WebSocket Connection Exposure
    • Impact: Unauthorized WebSocket connections could be initiated, leading to potential network probing.
    • Affected Systems: OpenClaw npm <= 2026.2.13
    • Immediate Action: Restrict gateway URL overrides and upgrade to version 2026.2.14 as soon as it's released.
    • Mitigation: Apply patch commit c5406e1d2434be2ef6eb4d26d8f1798d718713f4.
  • CVE-2026-25474: OpenClaw Telegram Webhook Authentication Flaw
    • Impact: Allows forged Telegram updates leading to unintended bot actions.
    • Affected Systems: OpenClaw npm <= 2026.1.30
    • Immediate Action: Set a strong webhook secret and restrict access to webhook endpoints.
    • Mitigation: Upgrade to version 2026.2.1 and apply config validation patches.
  • CVE-2026-26316: BlueBubbles Webhook Authentication Bypass
    • Impact: Unauthorized webhook events can be injected.
    • Affected Systems: OpenClaw BlueBubbles npm < 2026.2.13
    • Immediate Action: Set a secure webhook password and avoid public-facing proxy configurations.
    • Mitigation: Update to patched version and apply defense-in-depth measures.
  • CVE-2026-26278: fast-xml-parser Entity Expansion Denial-of-Service
    • Impact: Application freeze from excessive entity expansion.
    • Affected Systems: fast-xml-parser npm
    • Immediate Action: Disable DOCTYPE processing with processEntities: false.
    • Mitigation: Implement parser configuration changes to limit entity expansion.
  • CVE-2026-26275: httpsig-hyper Digest Verification Flaw
    • Impact: Incorrect digest verification allows message body tampering.
    • Affected Systems: httpsig-hyper Rust < 0.0.23
    • Immediate Action: Upgrade to version 0.0.23 immediately.
    • Mitigation: Enforce full HTTP message signature validation.
  • CVE-2026-26267: Rust Contract Macro Function Call Misrouting
    • Impact: Bypasses security checks by calling incorrect functions.
    • Affected Systems: soroban-sdk-macros Rust < 25.1.1
    • Immediate Action: Upgrade to version 25.1.1 and recompile contracts.
    • Mitigation: Avoid naming conflicts between inherent and trait functions.
  • CVE-2026-26324: OpenClaw SSRF Guard Bypass
    • Impact: Bypasses SSRF protections, potentially accessing restricted network areas.
    • Affected Systems: OpenClaw npm <= 2026.2.13
    • Immediate Action: Monitor for bypass attempts and apply SSRF guard patches.
    • Mitigation: Upgrade to version 2026.2.14 once available.
  • CVE-2026-26319: Telnyx Webhook Signature Verification Bypass
    • Impact: Unauthenticated Telnyx events could be processed.
    • Affected Systems: OpenClaw npm <= 2026.2.13
    • Immediate Action: Configure Telnyx public key for webhook verification.
    • Mitigation: Upgrade to version 2026.2.14 with enhanced verification.
  • CVE-2026-22860: Rack Directory Path Traversal Vulnerability
    • Impact: Directory listing outside of configured root, leading to information disclosure.
    • Affected Systems: Rack <= version prior to patch
    • Immediate Action: Update Rack to the latest patched version.
    • Mitigation: Avoid directory name overlaps with root path.
  • CVE-2026-26321: Feishu Plugin Local File Read Vulnerability
    • Impact: Attacker can read local files through media URL manipulation.
    • Affected Systems: OpenClaw Feishu plugin < 2026.2.14
    • Immediate Action: Upgrade to OpenClaw 2026.2.14 or newer.
    • Mitigation: Remove direct file reads and enforce local-root restrictions.
  • CVE-2026-26325: OpenClaw Command Execution Mismatch
    • Impact: Bypasses command allowlist, executing unapproved commands.
    • Affected Systems: OpenClaw npm <= 2026.2.13
    • Immediate Action: Enforce consistency checks between rawCommand and command[].
    • Mitigation: Upgrade to version 2026.2.14 and apply gateway validation patches.

What to Do Now

  1. Immediately upgrade affected packages to their patched versions as indicated.
  2. Implement recommended mitigations and workarounds to secure systems until upgrades are applied.
  3. Verify system configurations to ensure no residual vulnerabilities are present.
  4. Monitor network and application logs for unusual activity that could indicate exploit attempts.

Related Resources

  • Refer to official vendor advisories for detailed patch notes and technical guidance.
  • Check internal knowledge base articles for configuration tips and best practices.

Keep reading