PT-2026-23527 · Openclaw+1 · Openclaw+1

Megamansec

·

Published

2026-02-17

·

Updated

2026-03-07

·

CVE-2026-28448

CVSS v3.1

9.4

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.1.29 through 2026.2.0
Description The OpenClaw software, with the Twitch plugin installed and enabled, has an issue where access control is bypassed. Specifically, the allowFrom allowlist is not properly enforced when allowedRoles is not set or is empty. This allows unauthorized Twitch users to trigger agent dispatch by mentioning the bot in Twitch chat. The problematic logic resides in the checkTwitchAccessControl() function within the Twitch plugin (extensions/twitch/src/access-control.ts). When allowFrom is configured, the code does not return allowed: false for non-members, causing execution to continue. If allowedRoles is unset or empty, the function defaults to allowed: true, even when allowFrom is configured. This can lead to unintended actions, responses, and potential resource exhaustion for operators who relied on allowFrom to restrict bot invocation in Twitch chat.
Recommendations OpenClaw versions 2026.1.29 through 2026.2.0 should be upgraded to version 2026.2.1 or later.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-28448
GHSA-33RQ-M5X2-FVGF

Affected Products

Openclaw
Twitch Plugin