Openclaw cli: OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities (CVE-2026-26328)

The openclaw-cli iMessage group allowlist authorization logic incorrectly includes sender identities derived from the DM pairing store when evaluating group membership under the allowlist policy. Specifically, the vulnerable code in src/imessage/monitor/monitor-provider.ts computes effectiveGroupAllowFrom by combining the static group allowlist with DM pairing-store identities (storeAllowFrom). This allows a sender authorized via DM pairing to satisfy group authorization checks even if not explicitly listed in the group allowlist, weakening the intended separation between DM pairing and group authorization contexts. The vulnerability affects openclaw versions >=2026.1.29 and <2026.2.14 and clawdbot versions <=2026.1.24-3. Fix commits have been issued to correct this logic.

An attacker with a sender identity authorized via DM pairing could gain unauthorized access to iMessage groups protected by a strict allowlist policy, potentially allowing unauthorized group interactions. The vulnerability does not impact confidentiality but can lead to unauthorized group membership or interaction, representing an integrity impact. The CVSS score is 6.5 (medium severity) with network attack vector, low attack complexity, and requiring privileges but no user interaction.

A patch is available and should be applied to upgrade openclaw to versions >=2026.2.14 and clawdbot beyond 2026.1.24-3. The fix corrects the authorization logic to exclude DM pairing-store identities from satisfying group allowlist authorization. Users should apply these official fixes to remediate the vulnerability.