EUVD-2026-29138
GHSA-hf7p-489h-xhj4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
OpenClaw before 2026.4.20 contains a message classification vulnerability in Feishu card-action callbacks that misclassifies direct messages as group conversations. Attackers can bypass dmPolicy enforcement by triggering card-action flows in direct message conversations that should have been blocked by restrictive policies.
AnalysisAI
OpenClaw before version 2026.4.20 misclassifies direct messages as group conversations in Feishu card-action callbacks, allowing authenticated attackers to bypass dmPolicy restrictions and trigger card-action flows that should have been blocked. The vulnerability affects direct message handling in the Feishu integration and requires authenticated access (PR:L per CVSS vector) but achieves both confidentiality and integrity impact with moderate CVSS score of 5.4.
Technical ContextAI
OpenClaw is a JavaScript/TypeScript bot framework (npm package) that integrates with Feishu (ByteDance's enterprise messaging platform). The vulnerability exists in the Feishu card-action handler (extensions/feishu/src/bot.card-action.ts), which processes interactive card callbacks from Feishu. When a user clicks a card action in a direct message (Feishu chat_type 'p2p'), the handler previously failed to correctly resolve the chat_type from Feishu API responses, instead falling through to group message handling logic. This caused dmPolicy (direct message policy restrictions) to be skipped entirely. The root cause is improper message classification (CWE-184: Incomplete List of Disallowed Inputs), where the handler did not properly distinguish between p2p and group chat contexts. The fix adds explicit API lookup of Feishu chat metadata using the Feishu client's im.chat.get() endpoint, preferring chat_mode over chat_type field, and implements fallback to p2p classification on API errors to ensure dmPolicy is always enforced.
RemediationAI
Vendor-released patch: upgrade OpenClaw to version 2026.4.20 or later via npm (npm install openclaw@2026.4.20). The fix resolves Feishu card-action chat type classification by querying the Feishu API (im.chat.get) when stored context is missing, ensuring p2p chats are correctly identified before dmPolicy enforcement. The patch is available at commit 90979d7c3ef7ec30b9f8aa6963a5e38d2f17d166 on GitHub. No workarounds are available prior to patching; however, organizations can mitigate by restricting Feishu bot permissions to disable card-action handling entirely if card interactions are not required, or by implementing upstream network-level restrictions on Feishu API callbacks to your OpenClaw instance. Note that disabling card actions may reduce bot functionality. See advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-72q8-jcmc-97wx for full details.
Auth bypass in OpenClaw voice-call extension before 2026.2.1. EPSS 0.68%. PoC and patch available.
Privilege escalation in OpenClaw (pre-2026.3.28) allows unauthenticated remote attackers to gain administrative access b
OpenClaw versions 2026.2.22 through 2026.2.24 contain a privilege escalation vulnerability that allows authenticated att
An authorization mismatch vulnerability in OpenClaw versions prior to 2026.3.1 allows authenticated users with operator.
OpenClaw versions prior to 2026.1.29 automatically establish WebSocket connections to attacker-controlled gateway URLs e
Path traversal in OpenClaw through version 2026.3.23 enables unauthenticated remote attackers to read arbitrary files in
OpenClaw sandbox browser functionality launches x11vnc for noVNC observer sessions without requiring authentication, all
OpenClaw versions before 2026.2.26 allow authenticated attackers to write arbitrary files outside the workspace director
OpenClaw versions prior to 2026.2.22 contain a shell environment variable injection vulnerability in the system.run func
OpenClaw versions prior to 2026.2.22 contain a resource exhaustion vulnerability where the application fails to consiste
OpenClaw versions prior to 2026.3.1 contain a sandbox escape vulnerability that allows authenticated attackers with low
OpenClaw versions 2026.1.30 and below fail to validate Telegram webhook secret tokens when `channels.telegram.webhookSec
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today