GHSA-jv6r-27ww-4gw4: OpenClaw DM pairing-store identities could satisfy group allowlist authorization

March 3, 2026

DM pairing-store identities were incorrectly eligible for group allowlist authorization checks, enabling cross-context authorization in group message paths.

References

github.com/advisories/GHSA-jv6r-27ww-4gw4
github.com/openclaw/openclaw
github.com/openclaw/openclaw/commit/051fdcc428129446e7c084260f837b7284279ce9
github.com/openclaw/openclaw/commit/8bdda7a651c21e98faccdbbd73081e79cffe8be0
github.com/openclaw/openclaw/security/advisories/GHSA-jv6r-27ww-4gw4

Code Behaviors & Features

Detect and mitigate GHSA-jv6r-27ww-4gw4 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →