CVE-2026-32050: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-32050 is an incorrect authorization vulnerability in OpenClaw's Signal reaction notification handling that allows unauthorized senders to enqueue status events before access checks are applied. It affects all OpenClaw (npm) versions up to and including 2026.2.24, with the fix introduced in version 2026.2.25. The vulnerability was published on March 21, 2026, and assigned a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-863 (Incorrect Authorization): in src/signal/monitor/event-handler.ts, the reaction-only inbound event handling path called enqueueSystemEvent() before DM/group authorization checks were evaluated for the sender. This meant a sender not authorized for normal DM flow could still queue a Signal reaction status line for a session. The fix (commit 2aa7842) restructures the handler to resolve DM/group access decisions via shared resolveDmGroupAccessDecision() and resolveEffectiveAllowFromLists() functions before any reaction notification enqueue occurs, and adds regression test coverage for both allowlist and pairing dmPolicy modes (GitHub Advisory, Fix Commit).

Exploitation allows an unauthorized sender to inject Signal reaction status lines into agent session context for sessions they should not have access to, compromising the integrity of direct message and group channel communications. The vulnerability does not enable normal DM message delivery, direct host command execution, or exposure of confidential data — the impact is limited to integrity of session event queues. Affected sessions could have spurious or attacker-controlled reaction status events added to their context, potentially influencing agent behavior or logging (GitHub Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

1. Identify target: Locate an OpenClaw deployment running a version ≤ 2026.2.24 with Signal reaction notifications enabled (reactionMode set to all or own) and a restrictive dmPolicy (e.g., allowlist or pairing).
2. Craft a reaction-only Signal envelope: As an unauthorized sender (not in the allowFrom allowlist and not paired), send a Signal message containing only a reaction (emoji reaction, no body text or attachments) targeting a message in the victim session.
3. Trigger the vulnerable code path: The inbound reaction-only event enters the reaction && !hasBodyContent branch in event-handler.ts, which in unpatched versions calls enqueueSystemEvent() before DM/group authorization checks are evaluated.
4. Status event injected: The unauthorized reaction status line (e.g., "Signal reaction added: ✅") is enqueued into the agent session context without the sender ever passing access validation, potentially influencing agent behavior or polluting session logs (GitHub Advisory, Fix Commit).

• Logs: OpenClaw verbose logs showing signal reaction: entries from senders not present in the configured allowFrom list or not paired, without a corresponding Blocked signal reaction sender log line (which is only emitted in patched versions).
• Session/Agent Context: Unexpected "Signal reaction added" status lines appearing in agent session context from unknown or unauthorized Signal phone numbers.
• Application Behavior: Reaction status events attributed to senders who have never successfully completed DM pairing or are not on the allowlist, visible in session event queues or tool summaries (GitHub Advisory, Fix Commit).

Upgrade OpenClaw (npm package) to version 2026.2.25 or later, which enforces DM/group authorization checks before any reaction notification is enqueued. No configuration-based workaround is available for unpatched versions; disabling Signal reaction notifications (reactionMode) may reduce exposure but is not a complete mitigation. The patch is available via the fix commit 2aa7842adeedef423be7ce283a9144b9f1a0a669 (GitHub Advisory, Fix Commit).

The vulnerability was reported by researcher @tdjackey and disclosed responsibly through GitHub's security advisory process. The advisory was published by maintainer steipete on February 26, 2026, with the fix shipped in the same npm release (2026.2.25) that addressed several other security issues. No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified (GitHub Advisory).