OpenClaw versions >= 2026.6.9 and < 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin… (CVE-2026-100553)
OpenClaw versions from 2026.6.9 up to but not including 2026.8.1 have a vulnerability in the Feishu unpin feature where the native chatId parameter is not declared as a delivery target. This allows an authenticated sender to remove a pin from another Feishu group that they and the configured account can access, bypassing intended cross-context message mutation policies. The impact is limited to message mutation (pin removal) and requires Feishu membership and group authorization. The issue is fixed in version 2026.8.1.
AI Analysis
Technical Summary
OpenClaw versions >= 2026.6.9 and < 2026.8.1 fail to declare the native chatId parameter as a delivery target in the Feishu unpin feature. This omission allows unpin requests to bypass the shared same-provider cross-context target check. When the configuration option tools.message.crossContext.allowWithinProvider is disabled, an authenticated sender can remove pins from other Feishu groups accessible to both the sender and the configured account, circumventing the intended cross-context message mutation policy. The vulnerability affects only message mutation (pin removal) and respects Feishu membership and group authorization controls. The vulnerability is resolved in OpenClaw version 2026.8.1.
Potential Impact
An authenticated user with access to Feishu groups can remove pins from other groups they and the configured account can access, bypassing cross-context message mutation restrictions. The impact is limited to message mutation (pin removal) and does not affect confidentiality or availability.
Mitigation Recommendations
Upgrade OpenClaw to version 2026.8.1 or later where this vulnerability is fixed. No other mitigation is indicated. Since this is not a cloud service, remediation depends on applying the official fix.
OpenClaw versions >= 2026.6.9 and < 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin… (CVE-2026-100553)
Description
OpenClaw versions from 2026.6.9 up to but not including 2026.8.1 have a vulnerability in the Feishu unpin feature where the native chatId parameter is not declared as a delivery target. This allows an authenticated sender to remove a pin from another Feishu group that they and the configured account can access, bypassing intended cross-context message mutation policies. The impact is limited to message mutation (pin removal) and requires Feishu membership and group authorization. The issue is fixed in version 2026.8.1.
CVSS v3.1
Score 4.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenClaw versions >= 2026.6.9 and < 2026.8.1 fail to declare the native chatId parameter as a delivery target in the Feishu unpin feature. This omission allows unpin requests to bypass the shared same-provider cross-context target check. When the configuration option tools.message.crossContext.allowWithinProvider is disabled, an authenticated sender can remove pins from other Feishu groups accessible to both the sender and the configured account, circumventing the intended cross-context message mutation policy. The vulnerability affects only message mutation (pin removal) and respects Feishu membership and group authorization controls. The vulnerability is resolved in OpenClaw version 2026.8.1.
Potential Impact
An authenticated user with access to Feishu groups can remove pins from other groups they and the configured account can access, bypassing cross-context message mutation restrictions. The impact is limited to message mutation (pin removal) and does not affect confidentiality or availability.
Mitigation Recommendations
Upgrade OpenClaw to version 2026.8.1 or later where this vulnerability is fixed. No other mitigation is indicated. Since this is not a cloud service, remediation depends on applying the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-9w3x-7vmw-xp4x
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-100553"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ab74f2cf7a7c54106e13838
Added to database: 09/26/2026, 04:50:52 UTC
Last enriched: 09/26/2026, 04:55:16 UTC
Last updated: 09/26/2026, 06:27:43 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.