p PatchFirst

CVE-2026-44991

CVE-2026-44991 · OpenClaw < 2026.4.21 - Authorization Bypass in Owner-Enforced Commands via Wildcard Channel Senders

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

OpenClaw before 2026.4.21 contains an authorization bypass vulnerability in command-auth.ts that allows non-owner senders to execute owner-enforced slash commands when wildcard inbound senders are configured without explicit owner allowFrom settings. Attackers can exploit this by sending commands like /send, /config, or /debug on affected channels to bypass owner-only command authorization checks.

CVSS 2.3 · Baja · EPSS 0,2% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • openclaw

    Versiones
    • ≥ 0, < 2026.4.21: Afectada (semver)
    • 2026.4.21: No afectada (semver)

    Actualiza a 2026.4.21

  • openclaw npm

    Intervalos de versiones afectados
    • SEMVER: < 2026.4.21

    Actualiza a 2026.4.21

Fuentes originales

Comprueba tu servidor →