Most recent entries from all

BREW-openclaw-cli-CVE-2026-32027 — OpenClaw DM pairing-store identities could satisfy group allowlist authorization

2026-10-06T07:07:57.164511+00:00

Affected: Homebrew: openclaw-cli

## Summary DM pairing-store identities were incorrectly eligible for group allowlist authorization checks, enabling cross-context authorization in group message paths.

## Details In affected versions, group allowlist evaluation could inherit identities from the DM pairing store. A sender approved via DM pairing could satisfy group sender allowlist checks without being explicitly present in `groupAllowFrom`.

This is an authorization-policy boundary issue between DM pairing and group allowlists.

## Affected Packages / Versions - `openclaw` (npm): affected `<= 2026.2.25` (latest published npm version at triage time) - `openclaw` (npm): patched `>= 2026.2.26` (planned next release)

## Fix Commit(s) - `openclaw/openclaw@8bdda7a651c21e98faccdbbd73081e79cffe8be0` - `openclaw/openclaw@051fdcc428129446e7c084260f837b7284279ce9`

## Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.26`) so once npm release is published, maintainers can publish the advisory without additional metadata edits.

## Maintainer Timeline Note Maintainers landed the initial fix before this report was filed; this report still provided useful independent confirmation of the issue class and exploit path.

OpenClaw thanks @tdjackey for reporting.

cnvd-2026-14856

2026-10-06T07:07:57.164586+00:00

cnvd-2026-14856

EUVD-2026-329423

2026-10-06T07:07:57.164604+00:00

EUVD-2026-329423

fkie_cve-2026-32027

2026-10-06T07:07:57.164616+00:00

OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly eligible for group allowlist authorization checks. Attackers can exploit this cross-context authorization flaw by using a sender approved via DM pairing to satisfy group sender allowlist checks without explicit presence in groupAllowFrom, bypassing group message access controls.

GHSA-jv6r-27ww-4gw4 — OpenClaw DM pairing-store identities could satisfy group allowlist authorization

2026-10-06T07:07:57.164639+00:00

Affected: npm: openclaw

## Summary DM pairing-store identities were incorrectly eligible for group allowlist authorization checks, enabling cross-context authorization in group message paths.

This is an authorization-policy boundary issue between DM pairing and group allowlists.

## Affected Packages / Versions - `openclaw` (npm): affected `<= 2026.2.25` (latest published npm version at triage time) - `openclaw` (npm): patched `>= 2026.2.26` (planned next release)

## Fix Commit(s) - `openclaw/openclaw@8bdda7a651c21e98faccdbbd73081e79cffe8be0` - `openclaw/openclaw@051fdcc428129446e7c084260f837b7284279ce9`

## Maintainer Timeline Note Maintainers landed the initial fix before this report was filed; this report still provided useful independent confirmation of the issue class and exploit path.

OpenClaw thanks @tdjackey for reporting.

WID-SEC-W-2026-0586 — OpenClaw: Mehrere Schwachstellen

2026-10-06T07:07:57.164670+00:00

Ein Angreifer kann mehrere Schwachstellen in OpenClaw ausnutzen, um beliebigen Code auszuführen, sich erhöhte Berechtigungen zu verschaffen, Daten zu manipulieren, einen Denial-of-Service-Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere nicht näher spezifizierte Angriffe durchzuführen.