Listen to this Post
The vulnerability stems from a race condition in the Tlon extension where cite expansion (resolving @-mentions or channel references) is performed before channel and direct-message authorization checks complete. In affected versions of the openclaw npm package (<2026.3.22), the `extensions/tlon/src/monitor/index.ts` handler would expand cites and process associated content while the authorization decision was still pending. This allowed an unauthenticated or unauthorized user to trigger cite expansion, potentially exposing metadata, triggering side effects, or allowing content handling that should only be available after a successful auth. The flaw exists because the original code path did not defer cite expansion until after the authorization promise resolved. The fix moves the expansion logic into a deferred block that executes only after the authorization step finalizes, preserving explicit empty-allowlist semantics. Additionally, the commit 3cbf932413e41d1836cb91aed1541a28a3122f93 and ebee4e2210e1f282a982c7ef2ad79d77a572fc87 introduced changes in `monitor/utils.ts` and `security.test.ts` to enforce the new order and add regression tests. The fix shipped in v2026.3.22 and remains in v2026.3.23 and v2026.3.23-2. The issue was reported by @zpbrent.
Platform: openclaw npm
Version: < 2026.3.22
Vulnerability: Authorization bypass pre-auth
Severity: Critical
date: 2026-03-26
Prediction: Already patched 2026.3.22
What Undercode Say:
Check installed openclaw version npm list openclaw Update to patched version npm install [email protected] Verify fix commit presence git log --oneline | grep -E "3cbf932|ebee4e2"
Exploit:
An attacker could send crafted cite expansions (e.g., @channel or @user references) before the authorization handshake completes, causing the server to resolve internal identifiers and potentially process content without proper authentication, leading to information disclosure or unauthorized actions.
Protection from this CVE
Upgrade to openclaw >= 2026.3.22 immediately. If upgrading is not possible, apply the two referenced commits manually to enforce cite expansion after authorization and ensure empty-allowlist semantics are respected.
Impact:
Unauthorized metadata exposure, possible privilege escalation via early content handling, and bypass of channel/DM access controls, potentially compromising confidentiality and integrity of the messaging system.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
