CVE-2026-44993
CVE-2026-44993 · OpenClaw < 2026.4.20 - Direct Message Misclassification in Feishu Card Actions
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OpenClaw before 2026.4.20 contains a message classification vulnerability in Feishu card-action callbacks that misclassifies direct messages as group conversations. Attackers can bypass dmPolicy enforcement by triggering card-action flows in direct message conversations that should have been blocked by restrictive policies.
CVSS 2.3 · Low · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
Original sources
- https://github.com/openclaw/openclaw/security/advisories/GHSA-72q8-jcmc-97wx
- https://github.com/openclaw/openclaw/commit/90979d7c3ef7ec30b9f8aa6963a5e38d2f17d166
- https://www.vulncheck.com/advisories/openclaw-direct-message-misclassification-in-feishu-card-actions
- https://nvd.nist.gov/vuln/detail/CVE-2026-44993