CVE-2026-44991

OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners

Affected Packages / Versions

• Package: openclaw on npm
• Affected versions: <= 2026.4.20
• Patched version: 2026.4.21

The latest public release, 2026.4.21, contains the fix.

Workarounds

Upgrade to [email protected] or later. Before upgrading, avoid wildcard/open-DM sender policy on owner-enforced channels, or configure commands.ownerAllowFrom to the intended owner identities.

Credits

OpenClaw thanks @zsxsoft for reporting.

OpenClaw deployments before 2026.4.21 could treat a non-owner sender as authorized for owner-enforced slash commands when all of the following were true:

• a channel plugin declared commands.enforceOwnerForCommands: true;
• the channel accepted wildcard inbound senders with allowFrom: ["*"];
• no explicit commands.ownerAllowFrom was configured.

In that state, src/auto-reply/command-auth.ts reused the channel inbound wildcard as part of the command-owner decision. A sender who was not the owner could therefore pass the owner-command gate for commands such as /send, /config, or /debug on the affected channel.

The issue is limited to the command-owner authorization axis. It does not by itself grant owner-only tool access, host/sandbox access, or gateway administrator scope.

The application does not perform an authorization check before performing a sensitive operation. Typical impact: unauthorized access to restricted functionality or data.

Kodem intelligence

Already deployed Kodem?

The fix requires a concrete owner identity or internal operator-admin scope when a plugin enforces owner-only commands. Wildcard channel allowFrom no longer implies wildcard command ownership.

Fix commits:

• 2aa93d44a1b2c7058c371f261fda2b5d4de4a882 on main
• 995febb7b1e811ff6a1df5b18c22de94103f4c9f in the 2026.4.21 release line

1. What is CVE-2026-44991? CVE-2026-44991 is a medium-severity missing authorization vulnerability in openclaw (npm), affecting versions <= 2026.4.20. It is fixed in 2026.4.21. The application does not perform an authorization check before performing a sensitive operation.
2. Which versions of openclaw are affected by CVE-2026-44991? openclaw (npm) versions <= 2026.4.20 is affected.
3. Is there a fix for CVE-2026-44991? Yes. CVE-2026-44991 is fixed in 2026.4.21. Upgrade to this version or later.
4. Is CVE-2026-44991 exploitable, and should I be worried? Whether CVE-2026-44991 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-44991 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-44991? Upgrade openclaw to 2026.4.21 or later.

Other vulnerabilities in openclaw