OpenClaw before version 2026.3.31 permits an attacker to bypass the sender allowlist, enabling retrieval of restricted messages. The flaw arises when the system processes quoted, root, or threaded context messages, allowing unauthorized access to content that should be protected by the allowlist. The underlying weakness is a lack of proper authorization checks when handling message metadata, classified under CWE‑639.

Vulnerable products include the OpenClaw application, which is distributed as a Node.js package. All releases prior to 2026.3.31 are affected. Users who have configured a sender allowlist in their OpenClaw deployment are at risk and should verify their instance version.

The CVSS score of 2.3 indicates low severity, and no EPSS value is available, implying the exploitation likelihood is not quantified. The vulnerability is not listed in CISA’s KEV catalog. Attackers likely exploit the issue by sending crafted messages so that the server retrieves quoted or threaded messages, thereby bypassing the allowlist. A remote attacker would need network access to the OpenClaw instance and the ability to send or trigger message processing. Based on the description, it is inferred that the attack vector involves sending crafted messages that trigger processing of quoted or threaded content.