OpenClaw Authorization Bypass Vulnerability in Group Allowlist via DM Pairing Store Identity

A vulnerability allowing authorization bypass in group allowlist checks has been identified in OpenClaw versions prior to 2026.2.26. This issue arises because identities from the DM pairing store were incorrectly considered for group allowlist authorization. As a result, a sender approved through DM pairing could bypass group message access controls by satisfying group sender allowlist checks without being explicitly listed in the groupAllowFrom parameter.

Impact

Exploitation of this vulnerability allows for unauthorized group message access by incorrectly leveraging DM pairing-store approvals, creating a cross-context authorization flaw.

Reproduction

To reproduce this vulnerability, a sender must be approved through DM pairing. When this sender attempts to send a group message, the group allowlist checks will incorrectly validate their presence based on the DM pairing approval, bypassing the intended access controls.

Remediation

Users can update to OpenClaw version 2026.2.26 or later to address this vulnerability.