https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 17:01:01 +0000 https://vulnerability.circl.lu/vuln/cve-2026-31991 <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts sender identities from DM pairing-store approvals. Attackers can exploit this boundary weakness by obtaining DM pairing approval to bypass group allowlist checks and gain unauthorized group access.</p> <p><strong>Affected:</strong> OpenClaw</p> <p>OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts sender identities from DM pairing-store approvals. Attackers can exploit this boundary weakness by obtaining DM pairing approval to bypass group allowlist checks and gain unauthorized group access.</p> https://vulnerability.circl.lu/vuln/cve-2026-31991 https://vulnerability.circl.lu/vuln/ghsa-wm8r-w8pf-2v6w <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary In OpenClaw `2026.2.25`, Signal group authorization under `groupPolicy=allowlist` could accept sender identities sourced from DM pairing-store approvals. This allowed DM pairing approvals to leak into group allowlist evaluation.</p> <p>### Impact This is an authorization-boundary weakness between DM pairing and group allowlist controls. A sender approved for DM pairing could pass group checks without explicit group allowlisting.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published version affected: `2026.2.25` - Vulnerable range: `&lt;= 2026.2.25` - Patched version (planned next release): `&gt;= 2026.2.26`</p> <p>### Fix OpenClaw now keeps DM pairing-store entries DM-only and enforces explicit group allowlist boundaries in shared DM/group policy resolution used by Signal and other channels.</p> <p>### Fix Commit(s) - `8bdda7a651c21e98faccdbbd73081e79cffe8be0` - `64de4b6d6ae81e269ceb4ca16f53cda99ced967a`</p> <p>### Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.26`). After npm publish of that version, this advisory is ready to publish without further content edits.</p> <p>Thanks @tdjackey for reporting.</p> <p><strong>Affected:</strong> npm: openclaw</p> <p>### Summary In OpenClaw `2026.2.25`, Signal group authorization under `groupPolicy=allowlist` could accept sender identities sourced from DM pairing-store approvals. This allowed DM pairing approvals to leak into group allowlist evaluation.</p> <p>### Impact This is an authorization-boundary weakness between DM pairing and group allowlist controls. A sender approved for DM pairing could pass group checks without explicit group allowlisting.</p> <p>### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published version affected: `2026.2.25` - Vulnerable range: `&lt;= 2026.2.25` - Patched version (planned next release): `&gt;= 2026.2.26`</p> <p>### Fix OpenClaw now keeps DM pairing-store entries DM-only and enforces explicit group allowlist boundaries in shared DM/group policy resolution used by Signal and other channels.</p> <p>### Fix Commit(s) - `8bdda7a651c21e98faccdbbd73081e79cffe8be0` - `64de4b6d6ae81e269ceb4ca16f53cda99ced967a`</p> <p>### Release Process Note `patched_versions` is pre-set to the planned next release (`2026.2.26`). After npm publish of that version, this advisory is ready to publish without further content edits.</p> <p>Thanks @tdjackey for reporting.</p> https://vulnerability.circl.lu/vuln/ghsa-wm8r-w8pf-2v6w