CVE-2026-22170
MEDIUM
6,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
4,8
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: none
Description
AI Translation Available
OpenClaw versions prior to 2026.2.22 with the optional BlueBubbles plugin contain an access control bypass vulnerability where empty allowFrom configuration causes dmPolicy pairing and allowlist restrictions to be ineffective. Remote attackers can send direct messages to BlueBubbles accounts by exploiting the misconfigured allowlist validation logic to bypass intended sender authorization checks.
863
Incorrect Authorization
IncompleteCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Access Control
Availability
Potential Impacts:
Read Application Data
Read Files Or Directories
Modify Application Data
Modify Files Or Directories
Gain Privileges Or Assume Identity
Bypass Protection Mechanism
Execute Unauthorized Code Or Commands
Dos: Crash, Exit, Or Restart
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Dos: Resource Consumption (Other)
Applicable Platforms
Technologies:
Database Server, Not Technology-Specific, Web Server
https://github.com/openclaw/openclaw/commit/2ba6de7eaad812e5e8603018e14e54e96bd…
https://github.com/openclaw/openclaw/commit/4540790cb62412676f7b61cfc6e47443f84…
https://github.com/openclaw/openclaw/commit/51c0893673de8e5cea64e64351dbfa4680b…
https://github.com/openclaw/openclaw/commit/9632b9bcf032c5f2280c3103961fde912ab…
https://github.com/openclaw/openclaw/security/advisories/GHSA-jwf4-8wf4-jf2m
https://www.vulncheck.com/advisories/openclaw-bluebubbles-access-control-bypass…