https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 15:46:58 +0000 https://vulnerability.circl.lu/vuln/cve-2026-26328 <p><strong>Affected:</strong> openclaw, openclaw clawdbot</p> <p>OpenClaw is a personal AI assistant. Prior to version 2026.2.14, under iMessage `groupPolicy=allowlist`, group authorization could be satisfied by sender identities coming from the DM pairing store, broadening DM trust into group contexts. Version 2026.2.14 fixes the issue.</p> <p><strong>Affected:</strong> openclaw, openclaw clawdbot</p> <p>OpenClaw is a personal AI assistant. Prior to version 2026.2.14, under iMessage `groupPolicy=allowlist`, group authorization could be satisfied by sender identities coming from the DM pairing store, broadening DM trust into group contexts. Version 2026.2.14 fixes the issue.</p> https://vulnerability.circl.lu/vuln/cve-2026-26328 https://vulnerability.circl.lu/vuln/ghsa-g34w-4xqq-h79m <p><strong>Affected:</strong> npm: openclaw, npm: clawdbot</p> <p>## Summary Under iMessage `groupPolicy=allowlist`, group authorization could be satisfied by sender identities coming from the DM pairing store, broadening DM trust into group contexts.</p> <p>## Details Affected component: `src/imessage/monitor/monitor-provider.ts`.</p> <p>Vulnerable logic derived `effectiveGroupAllowFrom` using both the static group allowlist and DM pairing-store identities (`storeAllowFrom`). This allowed a sender approved via DM pairing to satisfy group authorization in groups even if the sender/chat was not explicitly present in `groupAllowFrom`.</p> <p>This weakens boundary separation between DM pairing and group allowlist authorization.</p> <p>## Affected Packages / Versions - `openclaw` (npm): affected `&lt;= 2026.2.13` - `clawdbot` (npm): affected `&lt;= 2026.1.24-3`</p> <p>## Fix Commit(s) - `openclaw/openclaw@872079d42fe105ece2900a1dd6ab321b92da2d59` - `openclaw/openclaw@90d1e9cd71419168b2faa54a759b124a3eacfae7`</p> <p>Thanks @vincentkoc for reporting.</p> <p><strong>Affected:</strong> npm: openclaw, npm: clawdbot</p> <p>## Summary Under iMessage `groupPolicy=allowlist`, group authorization could be satisfied by sender identities coming from the DM pairing store, broadening DM trust into group contexts.</p> <p>## Details Affected component: `src/imessage/monitor/monitor-provider.ts`.</p> <p>Vulnerable logic derived `effectiveGroupAllowFrom` using both the static group allowlist and DM pairing-store identities (`storeAllowFrom`). This allowed a sender approved via DM pairing to satisfy group authorization in groups even if the sender/chat was not explicitly present in `groupAllowFrom`.</p> <p>This weakens boundary separation between DM pairing and group allowlist authorization.</p> <p>## Affected Packages / Versions - `openclaw` (npm): affected `&lt;= 2026.2.13` - `clawdbot` (npm): affected `&lt;= 2026.1.24-3`</p> <p>## Fix Commit(s) - `openclaw/openclaw@872079d42fe105ece2900a1dd6ab321b92da2d59` - `openclaw/openclaw@90d1e9cd71419168b2faa54a759b124a3eacfae7`</p> <p>Thanks @vincentkoc for reporting.</p> https://vulnerability.circl.lu/vuln/ghsa-g34w-4xqq-h79m