Executive brief
OpenClaw is a library used to manage authorization controls for messaging channels including Signal groups. A flaw in how it handles user approval lists allows someone approved for direct messaging to bypass group allowlist restrictions and send messages to group chats without explicit group approval. An attacker could exploit this to send unauthorized messages to restricted Signal groups.
Technical details
The vulnerability is an authorization boundary weakness (CWE-863) in OpenClaw's DM pairing-store and group allowlist policy resolution. When evaluating group message access under groupPolicy=allowlist, the system incorrectly accepts sender identities from the DM pairing-store instead of enforcing explicit group allowlisting boundaries. The attack requires network access and low-level privileges (a user approved for DM pairing), plus user interaction. A sender approved for direct message pairing can bypass group allowlist checks without explicit group approval. The fix, implemented in version 2026.2.26, isolates DM pairing-store entries to DM-only scope and enforces strict group allowlist boundaries in shared policy resolution.
Affected products
- OpenClaw OpenClaw <= 2026.2.25
Timeline
- 2026-03-02: disclosed
- 2026-02-26: patched: Fix planned for version 2026.2.26