CVE-2026-44110

OpenClaw is affected by CVE-2026-44110, with vulnerability present in versions before 2026.4.15. The issue is an authorization bypass in Matrix room control-command authorization that trusts DM pairing-store entries. Attackers with DM-paired sender IDs can execute room control commands without be...

CVE-2026-28480

OpenClaw versions prior to 2026.2.14 contain an authorization bypass in Telegram allowlist matching: the system authenticates by mutable usernames rather than immutable numeric sender IDs. This enables attackers to spoof identity by recycling usernames and interact with bots as unauthorized sende...

EUVD-2026-9926

OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegram allowlist matching accepts mutable usernames instead of immutable numeric sender IDs. Attackers can spoof identity by obtaining recycled usernames to bypass allowlist restrictions and interact with...