CVE-2026-28448: OpenClaw Auth Bypass Vulnerability

CVE-2026-28448 Overview

OpenClaw versions 2026.1.29 prior to 2026.2.1 contain an authorization bypass vulnerability in the Twitch plugin. When the allowedRoles configuration is unset or empty, the plugin fails to enforce the allowFrom allowlist, allowing unauthorized Twitch users to trigger agent dispatch. Remote attackers can mention the bot in Twitch chat to bypass access control and invoke the agent pipeline, potentially causing unintended actions or resource exhaustion.

Critical Impact

Unauthorized users can bypass access controls to trigger agent actions, potentially leading to resource exhaustion or unintended automated behavior through the Twitch chat integration.

Affected Products

• OpenClaw versions 2026.1.29 to versions prior to 2026.2.1
• OpenClaw deployments with Twitch plugin installed and enabled
• Configurations where allowedRoles is unset or empty

Discovery Timeline

• 2026-03-05 - CVE-2026-28448 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28448

Vulnerability Analysis

This authorization bypass vulnerability (CWE-285: Improper Authorization) exists in the Twitch plugin component of OpenClaw. The flaw stems from a logic error in how the plugin evaluates access control policies when the allowedRoles configuration parameter is unset or contains an empty value.

Under normal operation, the plugin should enforce both the allowFrom allowlist and allowedRoles restrictions to determine which Twitch users can interact with the bot. However, when allowedRoles is not configured, the authorization check fails to properly enforce the allowFrom allowlist entirely.

The vulnerability is exploitable remotely via network access without authentication. An attacker simply needs to mention the bot in Twitch chat to trigger agent dispatch, bypassing the intended access control mechanisms. This could result in unauthorized command execution, unintended automated actions, or resource exhaustion through repeated invocations of the agent pipeline.

Root Cause

The root cause is improper authorization logic in the Twitch plugin's access control implementation. When the allowedRoles parameter is unset or empty, the code path that validates users against the allowFrom allowlist is bypassed or not executed correctly. This represents a failure to implement defense-in-depth where multiple authorization checks should operate independently.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with access to the Twitch chat where the OpenClaw bot is present can exploit this vulnerability by:

1. Identifying an OpenClaw instance with the Twitch plugin enabled
2. Confirming the target has allowedRoles unset or empty (default configuration)
3. Mentioning the bot in Twitch chat to trigger agent dispatch
4. Repeatedly invoking the agent pipeline to cause resource exhaustion or trigger unintended actions

The vulnerability exploitation details can be found in the GitHub Security Advisory.

Detection Methods for CVE-2026-28448

Indicators of Compromise

• Unexpected agent dispatch events triggered by unauthorized Twitch usernames
• Unusual patterns of bot mentions in Twitch chat logs from users not in the allowFrom allowlist
• Resource exhaustion symptoms such as high CPU or memory usage coinciding with Twitch chat activity

Detection Strategies

• Review OpenClaw logs for agent dispatch events triggered by users not in the configured allowFrom allowlist
• Monitor for abnormal frequency of agent pipeline invocations from the Twitch integration
• Implement alerting for agent dispatches originating from unknown or unauthorized Twitch usernames

Monitoring Recommendations

• Enable verbose logging for the Twitch plugin to capture all incoming chat events and authorization decisions
• Set up monitoring dashboards to track agent dispatch frequency and correlate with Twitch user sources
• Configure alerts for resource utilization spikes that may indicate exploitation attempts

How to Mitigate CVE-2026-28448

Immediate Actions Required

• Upgrade OpenClaw to version 2026.2.1 or later immediately
• If upgrade is not immediately possible, ensure allowedRoles is explicitly configured with at least one role value
• Review Twitch plugin configuration to ensure allowFrom allowlist is properly populated
• Audit recent agent dispatch logs for any unauthorized access attempts

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.2.1. The fix ensures that the allowFrom allowlist is properly enforced regardless of the allowedRoles configuration state. The patch can be reviewed in the GitHub commit.

Additional details are available in the GitHub Security Advisory and the VulnCheck Advisory.

Workarounds

• Explicitly set the allowedRoles configuration to a non-empty value to ensure proper authorization enforcement
• Temporarily disable the Twitch plugin if it is not critical to operations until the patch can be applied
• Implement network-level restrictions to limit access to the OpenClaw instance from trusted sources only

# Configuration example - Ensure allowedRoles is explicitly set
# In your OpenClaw configuration file (e.g., config.yaml):
# twitch:
#   enabled: true
#   allowFrom:
#     - trusted_user_1
#     - trusted_user_2
#   allowedRoles:
#     - moderator
#     - vip