CVE-2026-44991: Openclaw Auth Bypass Vulnerability

CVE-2026-44991 Overview

CVE-2026-44991 is an authorization bypass vulnerability [CWE-863] in OpenClaw versions prior to 2026.4.21. The flaw resides in command-auth.ts, where the command authorization logic incorrectly grants execution rights to non-owner senders when wildcard inbound senders are configured without explicit owner allowFrom settings. Attackers can issue owner-enforced slash commands such as /send, /config, or /debug on affected channels and bypass owner-only authorization checks. The vulnerability affects OpenClaw deployments running on Node.js where channel sender configurations rely on wildcard matching.

Critical Impact

Non-owner senders can execute owner-restricted slash commands on OpenClaw channels configured with wildcard inbound senders, leading to unauthorized command execution and configuration changes.

Affected Products

• OpenClaw (openclaw:openclaw) versions before 2026.4.21
• Node.js deployments of OpenClaw using wildcard inbound sender configurations
• OpenClaw channels with owner-enforced commands but no explicit owner allowFrom settings

Discovery Timeline

• 2026-05-11 - CVE-2026-44991 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44991

Vulnerability Analysis

The vulnerability stems from flawed authorization logic in OpenClaw's command authentication module. When an OpenClaw channel uses a wildcard inbound sender configuration and does not define explicit owner allowFrom rules, the command authorization resolver falls back to a permissive default. This default grants command execution when ownerState.allowAll is true, when no owner candidates are registered, or when any command-level owner match exists. Non-owner senders gain the ability to invoke commands intended exclusively for channel owners.

The flaw enables attackers to execute privileged slash commands including /send, /config, and /debug. These commands can alter channel configuration, trigger outbound messages, or expose debug information.

Root Cause

The root cause is a missing identity check in the command authorization branch [CWE-863]. The pre-patch logic accepted any of three weak conditions as proof of authorization rather than requiring positive verification that the sender is the channel owner. This violates the principle of explicit deny by default for owner-enforced commands.

Attack Vector

An authenticated low-privilege sender on a channel with wildcard inbound configuration submits an owner-enforced slash command. The authorization resolver evaluates the permissive fallback and approves the command. No user interaction from the legitimate owner is required.

// Vulnerable logic in src/auto-reply/command-auth.ts (pre-patch)
       ? true
       : ownerAllowlistConfigured
         ? senderIsOwner
-        : ownerState.allowAll ||
-          ownerState.ownerCandidatesForCommands.length === 0 ||
-          Boolean(matchedCommandOwner);
+        : senderIsOwnerByScope || Boolean(matchedCommandOwner);
   const isAuthorizedSender = resolveCommandSenderAuthorization({
     commandAuthorized,
     isOwnerForCommands,

Source: OpenClaw commit 2aa93d4

The patch replaces the permissive fallback with a positive owner-scope check (senderIsOwnerByScope), ensuring the sender's identity is verified against the owner scope before authorizing owner-enforced commands.

Detection Methods for CVE-2026-44991

Indicators of Compromise

• Execution of owner-restricted slash commands such as /send, /config, or /debug originating from non-owner sender identities.
• OpenClaw channel configurations using wildcard inbound senders without explicit owner allowFrom entries.
• Unexpected configuration changes or debug output generated through the auto-reply command pipeline.

Detection Strategies

• Audit OpenClaw channel configuration files for wildcard inbound sender definitions and missing owner allowFrom settings.
• Review application logs in the auto-reply/command-auth module for command authorization events where senderIsOwner is false but the command was authorized.
• Correlate slash command invocations with sender identity to identify non-owner senders executing owner-enforced commands.

Monitoring Recommendations

• Enable verbose logging on the OpenClaw command authorization pipeline to capture authorization decisions and the matched code path.
• Alert on any invocation of /send, /config, or /debug commands from senders not on the channel owner list.
• Track deployments of OpenClaw versions older than 2026.4.21 across the environment and prioritize them for remediation.

How to Mitigate CVE-2026-44991

Immediate Actions Required

• Upgrade OpenClaw to version 2026.4.21 or later, which contains the fix introduced in commits 2aa93d4 and 995febb.
• Inventory all OpenClaw channel configurations and remove wildcard inbound sender entries where they are not strictly required.
• Define explicit owner allowFrom settings for every channel that uses owner-enforced commands.

Patch Information

The fix is delivered in OpenClaw 2026.4.21. The relevant patches are tracked in the GitHub Security Advisory GHSA-c28g-vh7m-fm7v and applied via commits 2aa93d4 and 995febb. Additional context is available in the VulnCheck advisory.

Workarounds

• Replace wildcard inbound sender configurations with explicit allow lists of trusted sender identities.
• Add explicit owner allowFrom entries to all channels that expose owner-enforced commands such as /send, /config, or /debug.
• Disable owner-enforced slash commands on channels that cannot be reconfigured until the patch is applied.

# Update OpenClaw to the patched release
npm install openclaw@2026.4.21

# Verify installed version
npm list openclaw