Openclaw cli: OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners (CVE-2026-44991)

OpenClaw CLI versions <= 2026.4.20 improperly authorize non-owner senders for owner-enforced slash commands when a channel plugin has 'commands.enforceOwnerForCommands' set to true, accepts wildcard inbound senders via 'allowFrom: ["*"]', and lacks an explicit 'commands.ownerAllowFrom' configuration. The authorization logic reused the wildcard inbound sender permission as command ownership, allowing unauthorized users to bypass owner checks for certain commands. The vulnerability is limited to command-owner authorization and does not extend to host, sandbox, or gateway administrator privileges. The issue is resolved in version 2026.4.21 by requiring a concrete owner identity or internal operator-admin scope for owner-enforced commands and disallowing wildcard sender permissions to imply command ownership.

An attacker who is not the designated owner could execute owner-enforced commands on affected OpenClaw channels if the channel plugin configuration allows wildcard inbound senders and lacks explicit owner allowance settings. This could lead to unauthorized execution of sensitive commands such as /send, /config, or /debug on those channels. The vulnerability does not grant broader administrative or system-level access beyond the command-owner authorization scope.

Upgrade OpenClaw CLI to version 2026.4.21 or later, which contains the official fix. Before upgrading, avoid using wildcard or open-DM sender policies on owner-enforced channels or explicitly configure 'commands.ownerAllowFrom' to restrict command ownership to intended identities. The fix ensures that wildcard channel sender permissions no longer imply command ownership, enforcing stricter authorization checks.