CVE-2026-22170
OpenClaw < 2026.2.22 BlueBubbles - Access Control Bypass via Empty allowFrom Configuration
Vexday Risk Score
13Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 6.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Ciclo de vida
18 mar 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
OpenClaw versions prior to 2026.2.22 with the optional BlueBubbles plugin contain an access control bypass vulnerability where empty allowFrom configuration causes dmPolicy pairing and allowlist restrictions to be ineffective. Remote attackers can send direct messages to BlueBubbles accounts by exploiting the misconfigured allowlist validation logic to bypass intended sender authorization checks.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
OpenClaw · OpenClaw¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →Referencias
https://github.com/openclaw/openclaw/commit/2ba6de7eaad812e5e8603018e14e54e96bdd57ddhttps://github.com/openclaw/openclaw/commit/4540790cb62412676f7b61cfc6e47443f84a251ehttps://github.com/openclaw/openclaw/commit/51c0893673de8e5cea64e64351dbfa4680ba0dechttps://github.com/openclaw/openclaw/commit/9632b9bcf032c5f2280c3103961fde912ab1f920https://github.com/openclaw/openclaw/security/advisories/GHSA-jwf4-8wf4-jf2mhttps://www.vulncheck.com/advisories/openclaw-bluebubbles-access-control-bypass-via-empty-allowfrom-configuration