Executive brief
OpenClaw's Zalouser component manages access control for group-based message routing in an AI automation platform. The vulnerability allows attackers to bypass group authorization by creating a group with the same display name as an allowlisted group, potentially causing unintended groups to send messages to protected agents. This weakens channel isolation and could allow malicious actors to interact with automated systems they should not have access to.
Technical details
OpenClaw's Zalouser allowlist authorization was matching mutable group display names and normalized slugs instead of stable group identifiers. The vulnerability stems from CWE-807 (reliance on untrusted inputs in security decisions) and CWE-863 (incorrect authorization). When deployments configured name-based channel.zalouser.groups entries with permissive sender allowlists, an attacker could create a new group with a matching display name to bypass authorization checks. The vulnerability affects versions <= 2026.3.11 and is fixed in 2026.3.12, which now enforces matching against stable group IDs rather than mutable names.
Affected products
- OpenClaw OpenClaw <= 2026.3.11
Timeline
- 2026-03-13: disclosed
- 2026-03-12: patched: Fixed in version 2026.3.12