OpenClaw versions older than 2026.2.26 contain a policy flaw that incorrectly accepts sender identities approved in the DM pairing-store for the Signal group allowlist. This allows an attacker who can obtain a DM pairing approval to bypass the group allowlist and gain unauthorized access to protected Signal groups. The weakness corresponds to CWE-863, an Authorization Bypass through Privilege Escalation.

The affected product is OpenClaw:OpenClaw. All installations running OpenClaw prior to the 2026.2.26 release are vulnerable. No specific sub‑version range beyond "< 2026.2.26" is listed, so the vulnerability applies broadly to all earlier releases.

The CVSS base score is 2.0, indicating low severity, and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker first obtain DM pairing approval—a condition that may limit the attack vector to scenarios where the attacker can coerce or compromise an authorized user. Although the likelihood of exploitation is low, patching is recommended to eliminate the authorization bypass risk.