Executive brief
OpenClaw is an AI automation platform that integrates with messaging services like Zalo to enable automated workflows. The Zalo plugin includes controls to restrict which senders can dispatch group messages through configured allowlists. Due to a missing authorization check, an attacker can send group messages as an unauthorized sender and trigger the agent processing system, bypassing the intended access restrictions and potentially causing unauthorized actions or data exposure.
Technical details
This is an authorization bypass vulnerability (CWE-284, CWE-863) in OpenClaw's Zalo plugin GROUP message handling. The root cause is that group-sender access checks were not consistently enforced before dispatch. An unauthenticated or unauthorized sender could craft a GROUP message that enters the agent dispatch path even when the sender is not present in the configured group allowlist (groupAllowFrom or fallback allowFrom). The vulnerability is network-accessible and requires only the ability to send Zalo messages; no authentication to OpenClaw itself is required. The fix (commit b4010a0) adds explicit runtime group-policy evaluation and fail-closed behavior for missing provider configuration, ensuring all group senders are validated before dispatch. Patched in version 2026.2.24 and later.
Affected products
- OpenClaw openclaw <= 2026.2.23
Timeline
- 2026-02-25: disclosed: Advisory published
- 2026-02-25: patched: Patched version 2026.2.24 released on npm
- 2026-02-24: other: Fix commit b4010a0b627025c809c0e5dbdbd4770f3bc59ef8