Openclaw cli: OpenClaw has a Feishu allowFrom authorization bypass via display-name collision (CVE-2026-32021)
Description
OpenClaw CLI versions up to 2026.2.21-2 have a vulnerability in the Feishu allowlist authorization mechanism where an attacker can bypass authorization by exploiting display-name collisions. The allowlist is intended to match sender IDs, but the system incorrectly accepted mutable display names, allowing unauthorized senders to be authorized if their display name matched an allowlisted ID. This issue is fixed in version 2026.2.22 and later by enforcing strict ID-only matching and normalizing ID prefixes.
CVSS v3.1
Score 6.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The OpenClaw CLI's Feishu allowlist authorization feature relies on an ID-based allowlist (channels.feishu.allowFrom). However, the implementation mistakenly accepted mutable sender display names in the same namespace as valid IDs, enabling an attacker to bypass authorization by setting a display name equal to an allowlisted ID string. The fix enforces matching solely on normalized Feishu IDs and ignores display names for authorization checks, preventing this bypass.
Potential Impact
Deployments using Feishu allowlist-based authorization could mistakenly authorize non-allowlisted senders if those senders used a display name that collided with an allowlisted ID. This could lead to unauthorized access or actions being performed under the guise of an authorized sender.
Mitigation Recommendations
A patch is available and planned for release in OpenClaw CLI version 2026.2.22. Users should upgrade to version 2026.2.22 or later to ensure that Feishu allowlist authorization correctly enforces ID-only matching and prevents display-name collision bypasses.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-openclaw-cli-CVE-2026-32021
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6ac245bd12601ec6a3166bf2
Added to database: 10/04/2026, 12:25:33 UTC
Last enriched: 10/04/2026, 13:05:01 UTC
Last updated: 10/04/2026, 16:08:37 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.