Description
OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts sender identities from DM pairing-store approvals. Attackers can exploit this boundary weakness by obtaining DM pairing approval to bypass group allowlist checks and gain unauthorized group access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenClaw | OpenClaw | < 2026.2.26 | 2026.2.26 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | openclaw | < 2026.2.26 | 2026.2.26 | GHSA-wm8r-w8pf-2v6w |
References
- GitHub Security Advisory (GHSA-wm8r-w8pf-2v6w) vendor-advisory
- Patch Commit patch
- Patch Commit patch
- VulnCheck Advisory: OpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Leakage in Signal Group Allowlist third-party-advisory