GHSA-WM8R-W8PF-2V6W OpenClaw has Signal group allowlist authorization bypass via DM pairing-store leakage

Summary In OpenClaw 2026.2.25, Signal group authorization under groupPolicy=allowlist could accept sender identities sourced from DM pairing-store approvals. This allowed DM pairing approvals to leak into group allowlist evaluation. Impact This is an authorization-boundary weakness between DM...

Denial Of Service (DoS) Through Infinite Loop

github.com/mercari/gaurun is vulnerable to denial of service through infinite loop vulnerability. The vulnerability exists in the signalHandler function in gaurun.go. This is because a signal channel enters an infinite loop as it closes, consuming CPU memory which leads to a complete DoS conditio...