Openclaw cli: OpenClaw's elevated allowFrom accepted broader identity signals than specified within sender-scoped authorization

In OpenClaw CLI (npm package), the elevated sender authorization configuration 'tools.elevated.allowFrom' accepted broader identity signals than intended in versions up to 2026.2.21-2. Specifically, it matched on recipient routing fields such as 'ctx.To' which are not sender-scoped, potentially weakening authorization controls. The fix restricts matching to sender-scoped identity values only (SenderId, From, SenderE164) by default and requires explicit allowlist prefixes for mutable sender metadata fields (SenderName, SenderUsername, SenderTag). This change hardens authorization checks for elevated sender approval in the typical use case of 1:1 or trusted group chats. The patch is planned for version 2026.2.22.

The vulnerability could allow elevated sender approval to be granted based on broader identity signals than intended, weakening authorization controls. This may increase the risk of unauthorized elevated actions in contexts where sender identity is critical. However, the issue is described as an authorization hardening or defense-in-depth improvement rather than a direct exploit vector. No known exploits are reported in the wild.

A patch is available in OpenClaw CLI version 2026.2.22 that tightens identity matching to sender-scoped fields and requires explicit prefixes for mutable metadata. Users should upgrade to version 2026.2.22 once published to address this issue. Until then, consider reviewing elevated allowFrom configurations to ensure they do not rely on broader identity signals.