PT-2026-39682 · Openclaw · Openclaw
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
OpenClaw versions prior to 2026.4.20
Description
A message classification issue exists in Feishu card-action callbacks where direct messages are incorrectly identified as group conversations. This allows attackers to bypass
dmPolicy enforcement by triggering card-action flows within direct message conversations that should have been blocked by restrictive policies.Recommendations
Update to version 2026.4.20.
Exploit
Fix
Incorrect Authorization
Incomplete List of Disallowed Inputs
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openclaw