Nixpkgs security tracker

Dismissed

Permalink CVE-2026-31991

3.7 LOW

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): HIGH
Privileges required (PR): LOW
User interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality impact (C): LOW
Integrity impact (I): LOW
Availability impact (A): NONE

updated 1 month, 1 week ago by @pyrox0 Activity log

Created suggestion 1 month, 1 week ago
@pyrox0 dismissed 1 month, 1 week ago

OpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Leakage in Signal Group Allowlist

OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts sender identities from DM pairing-store approvals. Attackers can exploit this boundary weakness by obtaining DM pairing approval to bypass group allowlist checks and gain unauthorized group access.

References

GitHub Security Advisory (GHSA-wm8r-w8pf-2v6w) third-party-advisory
Patch Commit patch
Patch Commit patch
VulnCheck Advisory: OpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Leakage in Signal Group Allowlist third-party-advisory

Affected products

OpenClaw

<2026.2.26

Matching in nixpkgs

pkgs.openclaw

Self-hosted, open-source AI assistant/agent

nixos-unstable 2026.3.12
- nixpkgs-unstable 2026.3.12
- nixos-unstable-small 2026.3.12

Package maintainers

@chrisportela Chris Portela <chris@chrisportela.com>

version packaged is not vulnerable

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.openclaw

Package maintainers