CVE-2026-43583: OpenClaw Auth Bypass Vulnerability

CVE-2026-43583 Overview

CVE-2026-43583 affects OpenClaw versions 2026.4.10 through 2026.4.14 (exclusive). The flaw stems from the outbound delivery subsystem failing to persist session context when queued media entries are recovered after a service restart. Attackers with low privileges on a network-reachable instance can leverage this gap to replay outbound media without the original session-bound policy enforcement. The result is a bypass of group tool policy controls and a weakening of channel media restrictions during queue recovery. The issue is tracked under CWE-862: Missing Authorization.

Critical Impact
Recovered queued media bypass group tool policy enforcement, allowing attackers to weaken channel media restrictions after a service restart or recovery cycle.

Affected Products

OpenClaw 2026.4.10
OpenClaw versions after 2026.4.10 and before 2026.4.14
OpenClaw outbound delivery queue and recovery components

Discovery Timeline

2026-05-06 - CVE-2026-43583 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43583

Vulnerability Analysis

The vulnerability resides in OpenClaw's outbound media delivery pipeline. When a delivery operation cannot complete synchronously, the message metadata is written to a persistent queue for later replay. The queue serializer omitted the session field, which carries the authenticated session context used by downstream policy checks. On restart or recovery, the delivery worker rehydrates the queued entry and invokes the deliver function without that context. Group tool policies and channel media restrictions are evaluated against an empty or default session, so restrictions tied to the originating session are not enforced. An authenticated attacker can intentionally trigger queue persistence and force a recovery path to deliver media that would otherwise be blocked.

Root Cause

The missing authorization condition is anchored in two source files. In src/infra/outbound/deliver.ts, the queue write path did not include the session parameter alongside forceDocument, silent, mirror, and gatewayClientScopes. In src/infra/outbound/delivery-queue-recovery.ts, the recovery routine reconstructed the deliver call without rehydrating entry.session. Because policy enforcement depends on session-derived attributes, the absence of this field collapses the authorization decision to a permissive default.

Attack Vector

Exploitation requires network access and low privileges on the OpenClaw instance. The attacker submits outbound media that policy would normally restrict, ensuring the request is queued by inducing a transient delivery failure or coinciding with a recovery cycle. After service restart or queue recovery, the queued entry is replayed without session context, and the policy engine permits delivery. Attack complexity is high because the attacker must align timing with queue persistence and recovery.

typescript

// Patch: src/infra/outbound/deliver.ts — fix(outbound): replay queued session context (#66025)
         forceDocument: params.forceDocument,
         silent: params.silent,
         mirror: params.mirror,
+        session: params.session,
         gatewayClientScopes: params.gatewayClientScopes,
       }).catch(() => null); // Best-effort — don't block delivery if queue write fails.
// Source: https://github.com/openclaw/openclaw/commit/48aae82bbc19ba8b0741e61a08063eb0d1df464e

typescript

// Patch: src/infra/outbound/delivery-queue-recovery.ts — fix(outbound): replay queued session context (#66025)
     forceDocument: entry.forceDocument,
     silent: entry.silent,
     mirror: entry.mirror,
+    session: entry.session,
     gatewayClientScopes: entry.gatewayClientScopes,
     skipQueue: true, // Prevent re-enqueueing during recovery.
   } satisfies Parameters<DeliverFn>[0];
// Source: https://github.com/openclaw/openclaw/commit/48aae82bbc19ba8b0741e61a08063eb0d1df464e

The diff adds session to the queue write payload and the recovery replay payload. With the field present, downstream policy enforcement evaluates the original session attributes during replay and rejects deliveries that violate group tool policy.

Detection Methods for CVE-2026-43583

Indicators of Compromise

Outbound media deliveries that succeed immediately after a service restart but would be blocked under steady-state policy evaluation.
Audit log entries showing queue recovery replays without an associated session identifier or with a default/empty session field.
Spikes in deliveries originating from the delivery queue recovery worker rather than interactive user sessions.

Detection Strategies

Compare media delivery decisions captured during normal operation against those captured during recovery windows to surface policy drift.
Instrument the deliver function to log session context presence on every replay path and alert when it is absent.
Correlate group tool policy denials before a restart with successful deliveries of the same content after recovery completes.

Monitoring Recommendations

Monitor OpenClaw service restart events and queue recovery durations, then review media delivered during those intervals.
Track per-channel media restriction enforcement counters; sudden drops in denials may indicate policy bypass via the recovery path.
Forward OpenClaw outbound delivery and recovery logs to a centralized analytics platform for retention and historical comparison.

How to Mitigate CVE-2026-43583

Immediate Actions Required

Upgrade OpenClaw to version 2026.4.14 or later, which restores session context across queue persistence and recovery.
Audit outbound delivery and recovery logs for the period between deployment of 2026.4.10 and the upgrade to identify policy-violating deliveries.
Restrict network access to the OpenClaw service so that only trusted, low-privilege accounts can submit outbound media until the patch is applied.

Patch Information

The fix is published in commit 48aae82bbc19ba8b0741e61a08063eb0d1df464e and described in GHSA-r77c-2cmr-7p47. Additional context is available in the VulnCheck advisory on OpenClaw. The patch adds the session field to both the queue write path in deliver.ts and the replay payload in delivery-queue-recovery.ts.

Workarounds

Drain and discard the outbound delivery queue before restarting OpenClaw to prevent replay of unverified entries.
Disable queue-backed delivery for sensitive channels until the upgrade is applied, accepting reduced reliability in exchange for consistent policy enforcement.
Tighten group tool policy defaults so that deliveries lacking session context are denied at the policy layer rather than allowed.

bash

# Verify the running OpenClaw version and upgrade if vulnerable
openclaw --version

# Upgrade to the patched release
npm install openclaw@2026.4.14

# Drain the outbound delivery queue prior to restart
openclaw queue:flush --queue outbound-delivery --confirm

# Restart the service and confirm recovery completes cleanly
systemctl restart openclaw
journalctl -u openclaw -f | grep delivery-queue-recovery