CVE-2026-26328

OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities

State: Published
Severity: 6.5 Medium
Published: Feb 19, 2026
Updated: Feb 20, 2026
Reserved: Feb 13, 2026

Description

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, under iMessage `groupPolicy=allowlist`, group authorization could be satisfied by sender identities coming from the DM pairing store, broadening DM trust into group contexts. Version 2026.2.14 fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	GitHub_M

Weaknesses

CWE-284 Improper Access Control
CWE-863 Incorrect Authorization

Affected Products

Product	Versions
openclawopenclaw	< 2026.2.14Affected
clawdbotopenclaw	<= 2026.1.24-3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.