Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-26328

OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, under iMessage `groupPolicy=allowlist`, group authorization could be satisfied by sender identities coming from the DM pairing store, broadening DM trust into group contexts. Version 2026.2.14 fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

openclaw openclaw

  • < 2026.2.14affected

openclaw clawdbot

  • <= 2026.1.24-3affected

References