PT-2026-29258 · Openclaw+2 · Openclaw+2
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.3.28
Description
The software contains a sender policy bypass issue in the Google Chat and Zalouser extensions. Route-level group allowlist policies are silently downgraded to open policy, allowing attackers to bypass sender restrictions and interact with bots despite configured allowlist restrictions.
Recommendations
Update to version 2026.3.28 or later.
Exploit
Correção
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Google Chat
Openclaw
Zalouser