OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable group identifiers.
Date: 2026-03
Affected: openclaw/openclaw
Attack vector: other
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-22172
CVE-2026-32914
CVE-2026-32920
CVE-2026-32924
CVE-2026-32974
CVE-2026-32975
CVE-2026-33575
CVE-2026-34505
CVE-2026-34508
CWE: CWE-285
CWE-307
CWE-347
CWE-522
CWE-532
CWE-807
CWE-829
CWE-862
CWE-863
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable group identifiers. Attackers can create groups with identical names to allowlisted groups to bypass channel authorization and route messages from unintended groups to the agent.


Mitigations:

Architectural layers (MAESTRO):