CVE-2026-26328: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-26328 is an improper authorization vulnerability in OpenClaw, a personal AI assistant, affecting its iMessage integration. When groupPolicy=allowlist is configured, group authorization could be incorrectly satisfied by sender identities sourced from the DM (Direct Message) pairing store, effectively broadening DM-level trust into group chat contexts. The vulnerability affects the openclaw npm package versions ≤ 2026.2.13 and the clawdbot npm package versions ≤ 2026.1.24-3. It was disclosed on February 15, 2026, and published to the GitHub Advisory Database on February 18, 2026. The CVSS v3.1 base score is 6.5 (Medium) (GitHub Advisory, OpenClaw Security Advisory).

The root cause is a logic flaw in src/imessage/monitor/monitor-provider.ts classified under CWE-284 (Improper Access Control) and CWE-863 (Incorrect Authorization). The vulnerable code derived effectiveGroupAllowFrom by merging both the static groupAllowFrom configuration and DM pairing-store identities (storeAllowFrom), meaning any sender approved via DM pairing could satisfy group authorization checks even if that sender or chat was not explicitly listed in groupAllowFrom. An authenticated attacker who has been paired with the OpenClaw instance via DM can exploit this over the network (no user interaction required) by sending a message to a group chat, bypassing the intended allowlist restriction. The fix, applied in commit 872079d, removes storeAllowFrom from the effectiveGroupAllowFrom computation, scoping DM pairing-store authorization strictly to DM contexts (GitHub Advisory, Fix Commit).

Successful exploitation allows an authenticated attacker with DM pairing credentials to bypass group membership restrictions and send unauthorized messages or commands to group chats they should not have access to. This compromises message integrity and group confidentiality, potentially exposing sensitive group communications and enabling unauthorized command injection into the AI assistant's group context. There is no direct confidentiality or availability impact per the CVSS scoring, but the integrity impact is rated High, reflecting the ability to inject unauthorized content or commands (GitHub Advisory, OpenClaw Security Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.025% (2nd percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to already be paired with the target OpenClaw instance via DM, limiting the attack surface to authenticated users (GitHub Advisory, Feedly).

1. Prerequisite — Obtain DM Pairing: The attacker must first be approved as a DM-paired sender with the target OpenClaw instance (e.g., via the dmPolicy=pairing flow), establishing their identity in the storeAllowFrom pairing store.
2. Identify Target Group Chat: Identify an iMessage group chat where the OpenClaw instance is active and groupPolicy=allowlist is configured, but the attacker's identity is not explicitly listed in groupAllowFrom.
3. Send Message to Group: Send an iMessage to the target group chat from the DM-paired identity. Due to the vulnerable logic, effectiveGroupAllowFrom includes storeAllowFrom identities, so the authorization check passes.
4. Issue Unauthorized Commands: With group authorization satisfied, the attacker can send commands (e.g., /status or other control commands) to the OpenClaw AI assistant within the group context, achieving unauthorized command execution in the group channel (GitHub Advisory, Fix Commit).

• Logs: OpenClaw verbose logs showing group messages from senders not present in groupAllowFrom being processed rather than dropped; log entries indicating group authorization granted to DM-paired identities in group chat contexts.
• Application Behavior: Unexpected AI assistant responses or command executions in iMessage group chats from senders not explicitly listed in the group allowlist configuration.
• Configuration Review: Instances running openclaw ≤ 2026.2.13 or clawdbot ≤ 2026.1.24-3 with groupPolicy=allowlist and dmPolicy=pairing simultaneously configured are potentially affected (GitHub Advisory).

Upgrade to openclaw npm package version 2026.2.14 or later, or clawdbot version 2026.2.14 or later, which resolves the issue by removing DM pairing-store identities from group allowlist authorization. The fix is included in commits 872079d and 90d1e9c on the main branch. No configuration-based workaround is available; upgrading is the only remediation. Organizations should also review group chat access logs for any suspicious activity from DM-paired identities prior to patching (OpenClaw Release, OpenClaw Security Advisory).

The vulnerability was reported by security researcher @vincentkoc and acknowledged by the OpenClaw maintainers. A vulnerability digest was published by BeyondMachines noting that over 60 security vulnerabilities were resolved in the OpenClaw 2026.2.14 release, of which this iMessage authorization bypass was one (BeyondMachines). No broader media coverage or significant community debate has been observed beyond standard vulnerability tracking.