Executive brief
OpenClaw is a Google Chat integration library that uses allowlists to control which senders can trigger actions. The vulnerability allows an attacker with Google Workspace administrative access to reassign email addresses between accounts, bypassing authorization controls that rely on mutable email identifiers instead of immutable user IDs. This could enable unauthorized message relay or command execution if an allowlist mistakenly uses email addresses instead of the recommended immutable user identifiers.
Technical details
OpenClaw's Google Chat monitor (extensions/googlechat/src/monitor.ts) implements allowlist-based access control that accepts both immutable user IDs (users/<id>) and mutable email addresses (alice@example.com) as authorization criteria. Historically, the legacy format users/<email> was also treated as an email allowlist entry, but this is mutable at the IdP level. An attacker with Google Workspace administrative control can exploit this by reassigning an email address to a different underlying user account (different users/<id>), effectively bypassing authorization checks on deployments that rely on email-based allowlists. The fix deprecates the users/<email> format and clarifies that raw email allowlists remain supported while recommending immutable users/<id> for strict binding. Exploitation requires prior authentication as Google Chat and IdP-level administrative privilege, limiting practical risk to scenarios with chained failures.
Affected products
- OpenClaw openclaw <= 2026.2.13
- OpenClaw clawdbot <= 2026.1.24-3
Timeline
- 2026-02-17: disclosed: GHSA-chm2-m3w2-wcxm advisory published
- 2026-02-14: patched: Fix committed (PR #16243, commit c8424bf); openclaw patched in v2026.2.14; clawdbot has no patched release