CVE-2026-100556

Name of the Vulnerable Software and Affected Versions openclaw versions 2026.5.2 through 2026.8.0

Description An incorrect authorization issue exists in WhatsApp group handling. A group sender who is permitted to send ordinary messages but is restricted by commands.allowFrom or owner command authorization can use the /new <model> command to reset the shared group session and persist a provider and model override. This enables a restricted group member to select a provider and model already permitted by the operator for subsequent interactions in the shared group session, which may impact provider routing, cost, data flow, or availability. This issue does not allow the addition of new providers or the execution of host commands.

Recommendations Update openclaw to version 2026.8.1.