CVE-2026-22170: Openclaw Auth Bypass Vulnerability

CVE-2026-22170 Overview

CVE-2026-22170 is an access control bypass vulnerability in OpenClaw versions prior to 2026.2.22 when the optional BlueBubbles plugin is enabled. An empty allowFrom configuration causes the dmPolicy pairing logic and allowlist restrictions to become ineffective. Remote attackers can send direct messages to BlueBubbles accounts by bypassing sender authorization checks. The flaw is categorized under CWE-863: Incorrect Authorization.

Critical Impact
Unauthenticated remote attackers can deliver direct messages to BlueBubbles accounts that should be restricted by allowlist policy, bypassing intended sender authorization controls.

Affected Products

OpenClaw versions prior to 2026.2.22
OpenClaw deployments using the optional BlueBubbles plugin
Node.js-based OpenClaw installations with empty allowFrom configuration

Discovery Timeline

2026-03-18 - CVE-2026-22170 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-22170

Vulnerability Analysis

The vulnerability resides in the BlueBubbles plugin's sender authorization logic. When operators configure the plugin without populating the allowFrom field, the validation routine fails to enforce the intended deny-by-default posture. Instead of rejecting all senders when the allowlist is empty, the code treats the empty configuration as permissive.

This defect allows the dmPolicy pairing mechanism, which is designed to bind direct message capabilities to approved counterparts, to be circumvented. Any remote sender can initiate direct message interactions with the affected BlueBubbles account. The impact is limited to low confidentiality and low integrity exposure on the messaging channel, with no availability degradation.

Root Cause

The root cause is a logic error in how the allowlist validator interprets an unset or empty allowFrom array. Secure access control should fail closed when policy data is missing. In affected OpenClaw versions, the check fails open, granting access rather than denying it. This is a classic incorrect authorization defect ([CWE-863]).

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker identifies an exposed BlueBubbles endpoint running a vulnerable OpenClaw build with the misconfigured plugin. The attacker then issues direct message requests that should be filtered by the allowlist. Because the validator does not reject unlisted senders when allowFrom is empty, the messages are accepted and delivered.

No verified public exploit code is available. Technical details are documented in the VulnCheck Advisory and the GitHub Security Advisory GHSA-jwf4-8wf4-jf2m.

Detection Methods for CVE-2026-22170

Indicators of Compromise

Unexpected direct messages delivered to BlueBubbles accounts from senders not present in the configured allowlist
OpenClaw plugin configuration files where allowFrom is empty, missing, or set to an empty array
BlueBubbles plugin runtime logs showing accepted message events without a matching dmPolicy pairing record

Detection Strategies

Audit OpenClaw configuration files for BlueBubbles plugin entries and flag any with empty allowFrom values
Correlate inbound direct message events against the active allowlist to identify policy violations
Compare deployed OpenClaw versions against 2026.2.22 and flag any earlier build with the BlueBubbles plugin loaded

Monitoring Recommendations

Forward OpenClaw and BlueBubbles plugin logs to a centralized logging or SIEM platform for retention and search
Alert on configuration changes to the BlueBubbles plugin, particularly modifications to allowFrom and dmPolicy fields
Track unique sender identifiers interacting with BlueBubbles accounts to detect anomalous outreach patterns

How to Mitigate CVE-2026-22170

Immediate Actions Required

Upgrade OpenClaw to version 2026.2.22 or later, which corrects the allowlist validation logic
Inventory all OpenClaw deployments and identify any using the BlueBubbles plugin with empty allowFrom settings
Review BlueBubbles direct message history for unauthorized senders since the plugin was deployed

Patch Information

The maintainers addressed the issue across multiple commits referenced in the advisory. Review the fix commits at 2ba6de7, 4540790, 51c0893, and 9632b9b. Coordinated remediation guidance is published in the GitHub Security Advisory GHSA-jwf4-8wf4-jf2m.

Workarounds

Populate allowFrom with an explicit list of approved sender identifiers so the allowlist enforcement path executes correctly
Disable the BlueBubbles plugin entirely on hosts that cannot be upgraded immediately
Place affected OpenClaw instances behind a network policy that restricts inbound traffic to trusted sources

bash

# Configuration example: explicit allowlist for the BlueBubbles plugin
bluebubbles:
  dmPolicy: pairing
  allowFrom:
    - "trusted-sender-id-1"
    - "trusted-sender-id-2"