OpenClaw Authentication Bypass

The vulnerability of the AI agent OpenClaw formerly known as ClawdBot or MoltBot is related to deficiencies in the authorization process when processing the parameter groupPolicy=allowlist. Exploiting this vulnerability can allow a malicious actor to bypass existing security mechanisms remotely...

PT-2026-26388

Summary In [email protected], BlueBubbles group authorization could incorrectly treat DM pairing-store identities as group allowlist identities when dmPolicy=pairing and groupPolicy=allowlist. A sender that was only DM-paired not explicitly present in groupAllowFrom could pass group sender check...