CVE-2026-26328: OpenClaw iMessage Group Allowlist Authorization Vulnerability
Summary
CVE-2026-26328: OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities. Affects openclaw versions < 2026.2.14. Fixed in 2026.2.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenClaw is an open-source messaging application that integrates with iMessage, allowing users to manage group chats and direct messages. It is built on the npm ecosystem and is designed to facilitate secure communication. However, a vulnerability has been identified that affects its group authorization mechanism, potentially allowing unauthorized access to group chats.
Vulnerability Detail
The vulnerability arises from the way OpenClaw handles group authorization under the 'groupPolicy=allowlist' setting. Specifically, the logic used to derive 'effectiveGroupAllowFrom' improperly includes sender identities from the DM pairing store. This means that a sender who is authorized in direct messages could also gain access to group chats, even if they are not explicitly listed in the group allowlist. This flaw weakens the separation between direct messaging and group authorization, posing a risk of unauthorized access to sensitive group conversations.
How To Fix
Latest published version: 2026.10.6 as of 22 Oct 2026
npm install openclaw@2026.10.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.2.14
This is the first release that contains the fix.
npm install openclaw@2026.2.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the 'groupPolicy=allowlist' setting until they can update to the patched versions. This will prevent unauthorized access to group chats but may limit the functionality of group authorization.
Conclusion
The vulnerability CVE-2026-26328 in OpenClaw poses a significant risk by allowing unauthorized access to group chats through direct message sender identities. Users are advised to update their packages to the latest versions to mitigate this risk and ensure secure communication.
See every vulnerability recorded for openclaw →
FAQ
The vulnerability allows unauthorized sender identities from direct messages to access group chats, potentially compromising sensitive information.
OpenClaw versions 2026.2.13 and earlier are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
Yes, updating to the patched versions of OpenClaw and Clawdbot will resolve the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for openclaw.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
