PT-2026-26004 · Unknown+1 · Bluebubbles+1

Tdjackey · Published 2026-02-21 · Updated 2026-03-19 · CVE-2026-22170

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.22

Description OpenClaw, when used with the optional BlueBubbles plugin, has an access control issue. An empty 'allowFrom' configuration can cause the dmPolicy pairing and allowlist restrictions to be ineffective. This allows remote attackers to send direct messages to BlueBubbles accounts by bypassing the intended sender authorization checks. The issue stems from a misconfigured allowlist validation logic. The vulnerability affects deployments where the identifier is publicly reachable or agent tool permissions are broad, but poses a lower risk in personal setups with single-owner BlueBubbles identities. The isAllowedBlueBubblesSender() function, which delegates to isAllowedParsedChatSender(), previously returned true for empty allowlists, leading to the bypass.

Recommendations Update OpenClaw to version 2026.2.22 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2026-05044

CVE-2026-22170

GHSA-JWF4-8WF4-JF2M

Affected Products

Bluebubbles

Openclaw

References · 14

• https://github.com/openclaw/openclaw/security/advisories/GHSA-jwf4-8wf4-jf2m · Vendor Advisory
• https://github.com/openclaw/openclaw/commit/51c0893673de8e5cea64e64351dbfa4680ba0dec · Patch
• https://github.com/openclaw/openclaw/commit/2ba6de7eaad812e5e8603018e14e54e96bdd57dd · Patch
• https://github.com/openclaw/openclaw/commit/4540790cb62412676f7b61cfc6e47443f84a251e · Patch
• https://github.com/openclaw/openclaw/commit/9632b9bcf032c5f2280c3103961fde912ab1f920 · Patch
• https://osv.dev/vulnerability/CVE-2026-22170 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05044 · Security Note
• https://osv.dev/vulnerability/GHSA-jwf4-8wf4-jf2m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22170 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/VulmonFeeds/status/2034150408680009753 · Twitter Post
• https://twitter.com/CVEnew/status/2034136434173493558 · Twitter Post
• https://vulncheck.com/advisories/openclaw-bluebubbles-access-control-bypass-via-empty-allowfrom-configuration · Note
• https://twitter.com/CVEarity/status/2034543943917224303 · Twitter Post