CVE-2026-26328

6.5 mediumEPSS 0.3%

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, under iMessage `groupPolicy=allowlist`, group authorization could be satisfied by sender identities coming from the DM pairing store, broadening DM trust into group contexts. Version 2026.2.14 fixes the issue.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWEs: CWE-284, CWE-863
Published: 2026-02-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

openclaw:openclaw

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-g34w-4xqq-h79m	npm	openclaw	<2026.2.14	2026.2.14
GHSA-g34w-4xqq-h79m	npm	clawdbot	<2026.2.14	2026.2.14

References

https://github.com/openclaw/openclaw/commit/872079d42fe105ece2900a1dd6ab321b92da2d59
https://github.com/openclaw/openclaw/releases/tag/v2026.2.14
https://github.com/openclaw/openclaw/security/advisories/GHSA-g34w-4xqq-h79m

Check your stack JSON