Openclaw cli: OpenClaw has cross-account DM pairing authorization bypass via unscoped pairing store access (CVE-2026-32067)

OpenClaw CLI has an authorization boundary weakness (CVE-2026-32067) in its device message (DM) pairing store access. In multi-account channel deployments, the pairing approval granted in one account could be improperly reused to authorize the same sender in another account due to gaps in enforcing account-scoped pairing reads and writes. This vulnerability affects versions up to and including 2026.2.25. The upcoming release 2026.2.26 will patch this by enforcing consistent account-scoped pairing access across core and extension message channels, using stricter runtime and SDK helpers and shared policy wiring to prevent cross-account pairing bleed.

The vulnerability allows an attacker who has been approved as a sender in one account to bypass authorization controls and be accepted as an authorized sender in another account without explicit approval. This weakens the authorization boundary in multi-account deployments, potentially leading to unauthorized message sending across accounts. The CVSS score is 3.7 (low severity), indicating limited impact primarily on confidentiality and integrity with no availability impact.

A patch is available and planned for release in OpenClaw CLI version 2026.2.26. Users should upgrade to version 2026.2.26 or later once published to remediate this vulnerability. The fix enforces strict account-scoped pairing store access to prevent cross-account authorization bypass. Until the patch is applied, administrators should be aware of the risk in multi-account setups but no additional vendor-recommended mitigations are provided.