GHSA-vmvw-pwwf-cc2w: Duplicate Advisory: OpenClaw has cross-account DM pairing authorization bypass via unscoped pairing store access
(updated )
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-vjp8-wprm-2jw9. This link is maintained to preserve external references.
Original Description
OpenClaw versions prior to 2026.2.26 contains an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that allows attackers to reuse pairing approvals across multiple accounts. An attacker approved as a sender in one account can be automatically accepted in another account in multi-account deployments without explicit approval, bypassing authorization boundaries.
References
- github.com/advisories/GHSA-vmvw-pwwf-cc2w
- github.com/openclaw/openclaw/commit/a0c5e28f3bf0cc0cd9311f9e9ec2ca0352550dcf
- github.com/openclaw/openclaw/commit/bce643a0bd145d3e9cb55400af33bd1b85baeb02
- github.com/openclaw/openclaw/security/advisories/GHSA-vjp8-wprm-2jw9
- nvd.nist.gov/vuln/detail/CVE-2026-32067
- www.vulncheck.com/advisories/openclaw-cross-account-authorization-bypass-in-dm-pairing-store
Code Behaviors & Features
Detect and mitigate GHSA-vmvw-pwwf-cc2w with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →