Andrewcantina

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions 2026.6.9 through 2026.8.0 **Description** The Feishu unpin feature fails to declare the native `chatId` parameter as a delivery target. This allows unpin requests to bypass the shared same-provider cross-context target check. When the `tools.message.crossContext.allowWithinProvider` setting is disabled, an authenticated sender can remove a pin from a different Feishu group that both the sender and the configured account have permission to access. This bypasses the cross-context message mutation policy, although Feishu membership and group authorization remain in effect. **Recommendations** Update OpenClaw to version 2026.8.1.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions 2026.5.12 through 2026.8.0 **Description** When a paired node is revoked, the system fails to immediately invalidate Canvas HTTP authorization. While the WebSocket client is invalidated, the Canvas HTTP authorization continues to accept and renew the previously granted capability until the WebSocket close cleanup process is finished. This allows a revoked paired node to continue using its Canvas capability against configured routes during the close grace period. **Recommendations** Update to version 2026.8.1. As a temporary workaround, restart the Gateway after revoking a node that has Canvas access.

**Name of the Vulnerable Software and Affected Versions** openclaw versions 2026.5.2 through 2026.8.0 **Description** An incorrect authorization issue exists in WhatsApp group handling. A group sender who is permitted to send ordinary messages but is restricted by `commands.allowFrom` or owner command authorization can use the `/new <model>` command to reset the shared group session and persist a provider and model override. This enables a restricted group member to select a provider and model already permitted by the operator for subsequent interactions in the shared group session, which may impact provider routing, cost, data flow, or availability. This issue does not allow the addition of new providers or the execution of host commands. **Recommendations** Update openclaw to version 2026.8.1.