Executive brief
OpenClaw is an npm package for handling Signal messaging integrations in agent contexts. A flaw in the reaction-event processing path allowed unauthorized senders to enqueue status events without proper access validation, potentially adding unauthenticated reaction notifications to active sessions. The vulnerability is narrowly scoped to reaction-only inbound events and does not enable direct message delivery or command execution.
Technical details
This is an authorization bypass (CWE-863) in the Signal event-handler component (src/signal/monitor/event-handler.ts). The vulnerable code path enqueues a system status event via enqueueSystemEvent() before evaluating DM/group access checks for the sender, creating a window where unauthorized senders can inject reaction status events. The issue is limited to reaction-only inbound events with reaction notifications enabled and does not affect normal DM message handling or the pairing flow. An attacker not authorized for standard DM communication could queue a Signal reaction status line in the agent's context. The vulnerability requires network reachability to the Signal endpoint and affects all versions up to 2026.2.24; a fix was released in version 2026.2.25.
Affected products
- OpenClaw openclaw <= 2026.2.24
Timeline
- 2026-03-03: disclosed
- 2026-02-26: patched: Fix released in version 2026.2.25
- 2026-03-30: other: Advisory modified