CVE-2026-41910

OpenClaw before 2026.4.8 omits owner-only enforcement for cross-channel allowlist writes in the /allowlist endpoint. An authorized non-owner sender can bypass access controls to perform allowlist modifications against different channels, violating the intended trust model...

EUVD-2026-26116

OpenClaw before 2026.4.8 omits owner-only enforcement for cross-channel allowlist writes in the /allowlist endpoint. An authorized non-owner sender can bypass access controls to perform allowlist modifications against different channels, violating the intended trust model...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.8 contained security vulnerabilities. These vulnerabilities stemmed from the lack of cross-channel permission list writing that is performed only by the owner at the /allowlist...

PT-2026-35792

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.8 Description An access control bypass exists in the '/allowlist' endpoint where owner-only enforcement is omitted for cross-channel allowlist writes. This allows an authorized non-owner sender to bypass...