Openclaw cli: OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From

The vulnerability in OpenClaw CLI (npm package) versions <= 2026.2.22-2 involved the `commands.allowFrom` feature, which is intended as a sender authorization allowlist for commands. The root cause was that the function `resolveSenderCandidates()` always included `ctx.From` in sender candidate evaluation, but `ctx.From` could represent a conversation identity (e.g., Discord channel or WhatsApp group) rather than a single sender. This allowed participants in a conversation to gain command authorization if the allowlist contained conversation-like identifiers, effectively broadening command permissions. The fix, released in version 2026.2.23, changed the logic to treat `commands.allowFrom` strictly as sender-only, excluding `ctx.From` unless no other sender fields exist and the value is not conversation-shaped. Regression tests were added to ensure correct behavior.

Affected versions allowed command or directive authorization to be granted to unintended users within a conversation or group context when conversation identifiers were used in the allowlist. This could enable unauthorized participants in a channel or group to execute commands intended only for specific senders, potentially leading to unauthorized command execution within the affected environment.

A patch is available in OpenClaw CLI version 2026.2.23 that addresses this issue by restricting command authorization to sender-only identities and excluding conversation identifiers from sender candidate evaluation. Users should upgrade to version 2026.2.23 or later to remediate this vulnerability. No additional mitigation steps are required beyond applying the official fix.