Executive brief
OpenClaw is an open-source Signal integration library used to handle messaging and notifications. A flaw in its signal reaction-notification handling allowed unauthorized senders to queue status events without proper access validation, potentially adding unauthorized reaction status lines to agent sessions and bypassing intended access controls on direct messages and group communications.
Technical details
The vulnerability is an incorrect authorization (CWE-863) in OpenClaw versions prior to 2026.2.25, located in src/signal/monitor/event-handler.ts in the reaction-only inbound event handling path. The vulnerable code enqueues a system event via enqueueSystemEvent() before performing DM/group access authorization checks, allowing a sender without legitimate access to queue a Signal reaction status line for a target session. The flaw is triggered only in the narrow case of reaction-only inbound events with reaction notifications enabled; normal DM message delivery and command execution pathways are unaffected. The fix, released in version 2026.2.25, applies shared DM/group access checks before the reaction notification is enqueued.
Affected products
- OpenClaw openclaw <= 2026.2.24
Timeline
- 2026-02-26: disclosed
- 2026-02-25: patched: Version 2026.2.25 released with fix
- 2026-03-21: other: Duplicate advisory GHSA-86jj-29wc-7q2w published (later withdrawn 2026-03-24)