Description
OpenClaw is a personal AI assistant. Prior to version 2026.2.14, under iMessage `groupPolicy=allowlist`, group authorization could be satisfied by sender identities coming from the DM pairing store, broadening DM trust into group contexts. Version 2026.2.14 fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openclaw | openclaw | < 2026.2.14 | — |
| openclaw | clawdbot | <= 2026.1.24-3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | clawdbot | < 2026.2.14 | 2026.2.14 | GHSA-g34w-4xqq-h79m |
| npm | openclaw | < 2026.2.14 | 2026.2.14 | GHSA-g34w-4xqq-h79m |