6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26328

CVE-2026-26328: OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, under iMessage groupPolicy=allowlist, group authorization could be satisfied by sender identities coming from the DM pairing store, broadening DM trust into group contexts. Version 2026.2.14 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26328

CVE-2026-26328:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	< 2026.2.14	2026.2.14
clawdbot	npm	< 2026.2.14	2026.2.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper calculation of the group allowlist within the monitorIMessageProvider function in src/imessage/monitor/monitor-provider.ts. The commit 872079d42fe105ece2900a1dd6ab321b92da2d59 clearly shows the removal of storeAllowFrom (the DM pairing store identities) from the effectiveGroupAllowFrom set. The vulnerable line - const effectiveGroupAllowFrom = Array.from(new Set([...groupAllowFrom, ...storeAllowFrom])) explicitly demonstrates that the DM allowlist was being merged with the group allowlist. This allowed identities trusted for DMs to be trusted in group chats, which is an incorrect authorization logic. The fix, const effectiveGroupAllowFrom = Array.from(new Set(groupAllowFrom)), correctly scopes the group authorization to only the explicitly configured groupAllowFrom list. The second commit 90d1e9cd71419168b2faa54a759b124a3eacfae7 only updates the changelog and provides no new information about the vulnerable code.

Vulnerable functions

monitorIMessageProvider

src/imessage/monitor/monitor-provider.ts

The function `monitorIMessageProvider` was responsible for setting up message monitoring and authorization for iMessage. It incorrectly calculated the `effectiveGroupAllowFrom` list by merging the group allowlist (`groupAllowFrom`) with the Direct Message (DM) pairing store allowlist (`storeAllowFrom`). This allowed senders authorized for DMs to bypass group-specific authorization policies, as their identity from the DM pairing store was sufficient to grant them access to groups they were not explicitly allowed in.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.