Executive brief
OpenClaw is a messaging and collaboration tool that allows administrators to restrict who can execute elevated commands or access sensitive features. This vulnerability allowed the authorization system to incorrectly accept broader identity signals than intended, potentially permitting unauthorized users to execute privileged operations. This is a defense-in-depth issue mainly affecting configurations where elevated access controls are in place.
Technical details
The vulnerability is an authorization bypass (CWE-639) in OpenClaw's elevated sender authorization mechanism. The tools.elevated.allowFrom configuration incorrectly matched against recipient routing fields (ctx.To) in addition to sender identity fields, and accepted mutable metadata (SenderName, SenderUsername, SenderTag) without explicit allowlist prefixes. This allowed an attacker to craft requests that bypass sender-scoped authorization checks by leveraging unintended identity signals. The fix tightens matching to sender-scoped identity values only (SenderId, From, SenderE164) by default and requires explicit prefixes for mutable metadata. Patches are available in version 2026.2.22 and later.
Affected products
- OpenClaw openclaw <= 2026.2.21-2
Timeline
- 2026-03-04: disclosed: GHSA-f6h3-846h-2r8w published
- 2026-02-22: patched: Fix commit 6817c0ec7b4fa830123d4f5c340f075a4bd04ee2 authored; patched version 2026.2.22 planned