CVE-2026-26328

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, under iMessage `groupPolicy=allowlist`, group authorization could be satisfied by sender identities coming from the DM pairing store, broadening DM trust into group contexts. Version 2026.2.14 fixes the issue.

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - security-advisories@github.com

Published

2026-02-20

Last modified

2026-02-20

Weaknesses

CWE-284, CWE-863

Affected products

• Clawdbot (Openclaw)
• Openclaw (Openclaw)

References

• https://github.com/openclaw/openclaw/commit/872079d42fe105ece2900a1dd6ab321b92da2d59
• https://github.com/openclaw/openclaw/releases/tag/v2026.2.14
• https://github.com/openclaw/openclaw/security/advisories/GHSA-g34w-4xqq-h79m