CVE-2026-28448: OpenClaw Auth Bypass Vulnerability

CVE-2026-28448 Overview

OpenClaw versions 2026.1.29 prior to 2026.2.1 contain an authorization bypass vulnerability in the Twitch plugin. When the allowedRoles configuration is unset or empty, the plugin fails to enforce the allowFrom allowlist, allowing unauthorized Twitch users to trigger agent dispatch. Remote attackers can mention the bot in Twitch chat to bypass access control and invoke the agent pipeline, potentially causing unintended actions or resource exhaustion.

Critical Impact
Unauthorized users can bypass access controls to trigger agent actions, potentially leading to resource exhaustion or unintended automated behavior through the Twitch chat integration.

Affected Products

OpenClaw versions 2026.1.29 to versions prior to 2026.2.1
OpenClaw deployments with Twitch plugin installed and enabled
Configurations where allowedRoles is unset or empty

Discovery Timeline

2026-03-05 - CVE-2026-28448 published to NVD
2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28448

Vulnerability Analysis

This authorization bypass vulnerability (CWE-285: Improper Authorization) exists in the Twitch plugin component of OpenClaw. The flaw stems from a logic error in how the plugin evaluates access control policies when the allowedRoles configuration parameter is unset or contains an empty value.

Under normal operation, the plugin should enforce both the allowFrom allowlist and allowedRoles restrictions to determine which Twitch users can interact with the bot. However, when allowedRoles is not configured, the authorization check fails to properly enforce the allowFrom allowlist entirely.

The vulnerability is exploitable remotely via network access without authentication. An attacker simply needs to mention the bot in Twitch chat to trigger agent dispatch, bypassing the intended access control mechanisms. This could result in unauthorized command execution, unintended automated actions, or resource exhaustion through repeated invocations of the agent pipeline.

Root Cause

The root cause is improper authorization logic in the Twitch plugin's access control implementation. When the allowedRoles parameter is unset or empty, the code path that validates users against the allowFrom allowlist is bypassed or not executed correctly. This represents a failure to implement defense-in-depth where multiple authorization checks should operate independently.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with access to the Twitch chat where the OpenClaw bot is present can exploit this vulnerability by:

Identifying an OpenClaw instance with the Twitch plugin enabled
Confirming the target has allowedRoles unset or empty (default configuration)
Mentioning the bot in Twitch chat to trigger agent dispatch
Repeatedly invoking the agent pipeline to cause resource exhaustion or trigger unintended actions

The vulnerability exploitation details can be found in the GitHub Security Advisory.

Detection Methods for CVE-2026-28448

Indicators of Compromise

Unexpected agent dispatch events triggered by unauthorized Twitch usernames
Unusual patterns of bot mentions in Twitch chat logs from users not in the allowFrom allowlist
Resource exhaustion symptoms such as high CPU or memory usage coinciding with Twitch chat activity

Detection Strategies

Review OpenClaw logs for agent dispatch events triggered by users not in the configured allowFrom allowlist
Monitor for abnormal frequency of agent pipeline invocations from the Twitch integration
Implement alerting for agent dispatches originating from unknown or unauthorized Twitch usernames

Monitoring Recommendations

Enable verbose logging for the Twitch plugin to capture all incoming chat events and authorization decisions
Set up monitoring dashboards to track agent dispatch frequency and correlate with Twitch user sources
Configure alerts for resource utilization spikes that may indicate exploitation attempts

How to Mitigate CVE-2026-28448

Immediate Actions Required

Upgrade OpenClaw to version 2026.2.1 or later immediately
If upgrade is not immediately possible, ensure allowedRoles is explicitly configured with at least one role value
Review Twitch plugin configuration to ensure allowFrom allowlist is properly populated
Audit recent agent dispatch logs for any unauthorized access attempts

Patch Information

The vulnerability has been addressed in OpenClaw version 2026.2.1. The fix ensures that the allowFrom allowlist is properly enforced regardless of the allowedRoles configuration state. The patch can be reviewed in the GitHub commit.

Additional details are available in the GitHub Security Advisory and the VulnCheck Advisory.

Workarounds

Explicitly set the allowedRoles configuration to a non-empty value to ensure proper authorization enforcement
Temporarily disable the Twitch plugin if it is not critical to operations until the patch can be applied
Implement network-level restrictions to limit access to the OpenClaw instance from trusted sources only

bash

# Configuration example - Ensure allowedRoles is explicitly set
# In your OpenClaw configuration file (e.g., config.yaml):
# twitch:
#   enabled: true
#   allowFrom:
#     - trusted_user_1
#     - trusted_user_2
#   allowedRoles:
#     - moderator
#     - vip