PT-2026-39680 · Openclaw · Openclaw

Keensecuritylab · Published 2026-04-29 · Updated 2026-05-11 · CVE-2026-44991

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.21

Description An authorization bypass exists in command-auth.ts that allows non-owner senders to execute owner-enforced slash commands. This occurs when wildcard inbound senders are configured without explicit owner allowFrom settings. Attackers can bypass owner-only authorization checks by sending commands such as '/send', '/config', or '/debug' on affected channels.

Recommendations Update to version 2026.4.21.

Fix

Missing Authorization

Incorrect Authorization

Weakness Enumeration

CWE-862

CWE-863

Related Identifiers

CVE-2026-44991

GHSA-C28G-VH7M-FM7V

GHSA-P3PV-C954-9M6F

Affected Products

Openclaw

References · 10

• https://github.com/openclaw/openclaw/commit/2aa93d44a1b2c7058c371f261fda2b5d4de4a882 · Patch
• https://github.com/openclaw/openclaw/commit/995febb7b1e811ff6a1df5b18c22de94103f4c9f · Patch
• https://github.com/openclaw/openclaw/security/advisories/GHSA-c28g-vh7m-fm7v · Vendor Advisory
• https://vulncheck.com/advisories/openclaw-authorization-bypass-in-owner-enforced-commands-via-wildcard-channel-senders · Patch
• https://osv.dev/vulnerability/GHSA-p3pv-c954-9m6f · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c28g-vh7m-fm7v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44991 · Security Note
• https://github.com/openclaw/openclaw · Note
• https://twitter.com/CVEnew/status/2053932443019976887 · Twitter Post
• https://t.me/CVEtracker/53377 · Telegram Post