Openclaw cli: OpenClaw: Feishu thread history and quoted messages bypass sender allowlist (CVE-2026-41406)

CVE-2026-41406 describes a vulnerability in the openclaw npm package (openclaw-cli) where Feishu thread history and quoted messages bypass the sender allowlist. This means that messages fetched as quoted or in thread context can bypass sender restrictions intended to limit message sources. The vulnerability affects versions from 2026.1.29 up to but not including 2026.3.31. The fix was introduced in version 2026.3.31, with the relevant commit dated 2026-03-31. The CVSS 3.1 score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and low confidentiality and integrity impacts.

The vulnerability allows bypassing sender allowlists in Feishu thread history and quoted messages, potentially permitting unauthorized message content to be processed or displayed. The impact is limited to confidentiality and integrity with no availability impact. There are no known exploits in the wild.

Users should upgrade openclaw-cli to version 2026.3.31 or later to apply the official fix. The vulnerability is patched in these versions. No additional mitigation steps are indicated by the vendor advisory.