CVE-2026-26328

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Feb 19, 2026
Source updated: Feb 20, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, under iMessage `groupPolicy=allowlist`, group authorization could be satisfied by sender identities coming from the DM pairing store, broadening DM trust into group contexts. Version 2026.2.14 fixes the issue.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

openclaw

Vendor: openclaw
Product: openclaw
Platforms: Unknown
Default status: Unknown

openclaw · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
< 2026.2.14	`affected`	Unavailable	Unavailable	Unavailable	None listed

clawdbot

Vendor: openclaw
Product: clawdbot
Platforms: Unknown
Default status: Unknown

clawdbot · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
<= 2026.1.24-3	`affected`	Unavailable	Unavailable	Unavailable	None listed