CVE-2026-31991: OpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Leakage in Signal Group Allowlist
OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts sender identities from DM pairing-store approvals. Attackers can exploit this boundary weakness by obtaining DM pairing approval to bypass group allowlist checks and gain unauthorized group access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClawto a version that resolves this vulnerability.Fixed in 2026.2.26
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31991?
CVE-2026-31991 has been classified as a high severity vulnerability due to its potential for authorization bypass.
How do I fix CVE-2026-31991?
To fix CVE-2026-31991, you should upgrade to OpenClaw version 2026.2.26 or later.
What impact does CVE-2026-31991 have on users?
CVE-2026-31991 allows attackers to bypass authorization mechanisms and potentially access sensitive data.
Which versions of OpenClaw are affected by CVE-2026-31991?
OpenClaw versions prior to 2026.2.26 are affected by CVE-2026-31991.
Is there a workaround for CVE-2026-31991?
There are currently no known workarounds for CVE-2026-31991; upgrading is the recommended mitigation.