CVE-2026-100566: OpenClaw LINE before 2026.8.1 Access Control Inheritance
OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite configured group allowlist restrictions when DM access is broader than intended group access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClaw LINEto a version that resolves this vulnerability.Fixed in 2026.8.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
OpenClaw LINE deployments before 2026.8.1 are affected when group allowlist mode is used and groupAllowFrom is not explicitly configured. The exposure is greatest where DM allowFrom permits identities that should not be allowed to trigger the agent in groups.
What does an attacker need to exploit it?
An attacker needs to participate in a group where the affected agent is present and have an identity permitted by the inherited DM allowFrom values. No authentication beyond that access is indicated.
Are group allowlist restrictions effective by default in the affected configuration?
No. If groupAllowFrom is omitted, group allowlist mode silently inherits the DM allowFrom values, which can make group access broader than the intended group-specific restriction.
What can be done before upgrading?
Explicitly configure groupAllowFrom with the intended permitted group identities rather than relying on inherited DM allowFrom values. Review DM allowFrom entries because those values may currently define effective group access.