CVE-2026-32027 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly eligible for group allowlis…
High CVSS: 7.1

CVE-2026-32027

OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly eligible for group allowlist authorization checks. Attackers can exploit this cross-context authorization flaw by using a sender approved via DM pairing to satisfy group sender allowlist checks without explicit presence in groupAllowFrom, bypassing group message access controls.
Vendor
Openclaw
Product
Openclaw
CWE
CWE-863
Yayın Tarihi
2026-03-19 22:16:37
Güncelleme
2026-03-26 17:16:35
Source Identifier
disclosure@vulncheck.com
KEV Date Added
-

Kategoriler

CWE-863 Openclaw HIGH Openclaw 2026

Referanslar

https://github.com/openclaw/openclaw/commit/051fdcc428129446e7c084260f837b7284279ce9 https://github.com/openclaw/openclaw/commit/8bdda7a651c21e98faccdbbd73081e79cffe8be0 https://github.com/openclaw/openclaw/security/advisories/GHSA-jv6r-27ww-4gw4 https://www.vulncheck.com/advisories/openclaw-improper-authorization-via-dm-pairing-store-identity-inheritance-in-group-allowlist