PT-2026-26748 · Openclaw · Openclaw
CVSS v4.0
5.3
Média
| Vetor | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.2.25
Description
The software does not consistently enforce sender-policy checks on
reaction * and pin * non-message events before incorporating them into the system-event context. This allows attackers to circumvent established Direct Message policies and user allowlists, enabling the injection of unauthorized reaction and pin events originating from restricted senders.Recommendations
Update OpenClaw to version 2026.2.25 or later.
Exploit
Correção
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Openclaw