OpenClaw Authorization Bypass Vulnerability in Group Allowlist Policy Evaluation

A vulnerability allowing authorization bypass in group allowlist evaluations has been identified in OpenClaw versions prior to 2026.2.26. This issue arises from the acceptance of sender identities from direct message (DM) pairing-store approvals, which can be exploited to gain unauthorized access to groups by leveraging DM pairing approvals to bypass group allowlist checks.

Impact

Exploitation of this vulnerability creates an authorization boundary weakness, allowing approved senders from DM pairing to bypass group allowlist controls and access groups without explicit permission.

Reproduction

To reproduce this vulnerability, obtain DM pairing approval from a user. Then, send a message to a group where the group allowlist policy is active. The message will be accepted, bypassing the allowlist checks, due to the unauthorized group's access being granted through the leaked DM pairing approval.

Remediation

Users can update to OpenClaw version 2026.2.26 or later, where this vulnerability has been patched.