Summary
OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From
commands.allowFrom is documented as a sender authorization allowlist for commands/directives, but command authorization could include ctx.From (conversation identity) as a sender candidate.
When commands.allowFrom contained conversation-like identifiers (for example Discord channel:<id> or WhatsApp group JIDs), command/directive authorization could be granted to participants in that conversation instead of only the intended sender identity.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected versions:
<= 2026.2.22-2 - Patched version:
2026.2.23(released)
Details
Root cause: resolveSenderCandidates() in src/auto-reply/command-auth.ts always included ctx.From in candidate evaluation used by commands.allowFrom authorization checks.
ctx.From is sender-like in some direct-message contexts, but conversation-like in channel/group/thread contexts. This mixed principal handling allowed conversation identifiers to satisfy sender-only authorization.
Fix Commit(s)
08e2aa44e78a9c946d97bea62304e6f533b8fa8e
Release Process Note
patched_versions is pre-set to the released version (2026.2.23). This advisory now reflects released fix version 2026.2.23.
OpenClaw thanks @jiseoung for reporting.
Impact
In affected versions, command/directive authorization could become broader than intended when operators configured commands.allowFrom with conversation identifiers, allowing unintended users in that conversation to run command-only/directive-only flows.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Main branch now treats commands.allowFrom as sender-only:
ctx.Fromis no longer included as a general sender candidate.ctx.Fromis only used as fallback when sender fields are absent and the value is not conversation-shaped.- Regression tests were added for conversation-id denial and direct-message fallback preservation.
Frequently Asked Questions
- What is GHSA-2CH6-X3G4-7759? GHSA-2CH6-X3G4-7759 is a high-severity security vulnerability in openclaw (npm), affecting versions < 2026.2.23. It is fixed in 2026.2.23.
- Which versions of openclaw are affected by GHSA-2CH6-X3G4-7759? openclaw (npm) versions < 2026.2.23 is affected.
- Is there a fix for GHSA-2CH6-X3G4-7759? Yes. GHSA-2CH6-X3G4-7759 is fixed in 2026.2.23. Upgrade to this version or later.
- Is GHSA-2CH6-X3G4-7759 exploitable, and should I be worried? Whether GHSA-2CH6-X3G4-7759 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-2CH6-X3G4-7759 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-2CH6-X3G4-7759? Upgrade
openclawto 2026.2.23 or later.