The OpenClaw npm package prior to version 2026.7.1 incorrectly binds Signal approval reactions. Specifically, a reaction intended to resolve a structured approval request may instead attach to unrelated outbound text messages when both unrelated messages and a pending approval exist in the same conversation. This misbinding can cause an approver's reaction to unrelated text to be interpreted as an approval or denial of a pending host action. The impact depends on the nature of the pending request, timing within the conversation, and the actions available to the OpenClaw process. The vulnerability does not alter the authority of correctly identified approvers. The issue is addressed in version 2026.7.1.

An attacker or user could cause an approver's reaction to unrelated text messages to be misinterpreted as approval or denial of a pending host action. This could lead to unintended execution or denial of actions controlled by OpenClaw. The severity is high due to potential confidentiality, integrity, and availability impacts as indicated by the CVSS score of 7.1. However, the authority of legitimate approvers remains intact, limiting the scope of privilege escalation.

Upgrade OpenClaw to version 2026.7.1 or later, where this issue is fixed. No other mitigation is indicated or required.