Most recent entries from all

bdu:2026-05012

2026-09-28T18:33:56.821080+00:00

bdu:2026-05012

BREW-openclaw-cli-CVE-2026-31991 — OpenClaw has Signal group allowlist authorization bypass via DM pairing-store leakage

2026-09-28T18:33:56.821147+00:00

Affected: Homebrew: openclaw-cli

### Summary In OpenClaw `2026.2.25`, Signal group authorization under `groupPolicy=allowlist` could accept sender identities sourced from DM pairing-store approvals. This allowed DM pairing approvals to leak into group allowlist evaluation.

### Impact This is an authorization-boundary weakness between DM pairing and group allowlist controls. A sender approved for DM pairing could pass group checks without explicit group allowlisting.

### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published version affected: `2026.2.25` - Vulnerable range: `<= 2026.2.25` - Patched version (planned next release): `>= 2026.2.26`

### Fix OpenClaw now keeps DM pairing-store entries DM-only and enforces explicit group allowlist boundaries in shared DM/group policy resolution used by Signal and other channels.

### Fix Commit(s) - `8bdda7a651c21e98faccdbbd73081e79cffe8be0` - `64de4b6d6ae81e269ceb4ca16f53cda99ced967a`

### Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.26`). After npm publish of that version, this advisory is ready to publish without further content edits.

Thanks @tdjackey for reporting.

fkie_cve-2026-31991

2026-09-28T18:33:56.821235+00:00

OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts sender identities from DM pairing-store approvals. Attackers can exploit this boundary weakness by obtaining DM pairing approval to bypass group allowlist checks and gain unauthorized group access.

Withdrawn: GHSA-r849-826x-wgqm — Duplicate Advisory: Signal group allowlist authorization bypass via DM pairing-store leakage

2026-09-28T18:33:56.821280+00:00

Withdrawn by the publisher.

Affected: npm: openclaw

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-wm8r-w8pf-2v6w. This link is maintained to preserve external references.

## Original Description OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts sender identities from DM pairing-store approvals. Attackers can exploit this boundary weakness by obtaining DM pairing approval to bypass group allowlist checks and gain unauthorized group access.