CVE-2026-22170: OpenClaw empty allowlist bypasses

CISO Take

OpenClaw's optional BlueBubbles plugin ships a dmPolicy pairing and allowlist mechanism meant to restrict who can message the agent, but when the allowFrom configuration is left empty that check fails open, letting any remote sender direct-message the agent without authorization. This is a network-exploitable, no-auth, no-user-interaction bug (CVSS 6.5, AC:L/PR:N/UI:N), so any deployment that left allowFrom unset is trivially reachable by an unauthenticated attacker, though the confidentiality/integrity impact is capped at 'low' and it's absent from CISA KEV, has no public exploit or Nuclei template, and sits at only the 83rd EPSS percentile with SSVC 'Track' — meaning opportunistic mass exploitation is unlikely today. The real concern is what this channel enables: OpenClaw is an autonomous agent with a documented history of acting on untrusted input (AIID #1368, #1471, #1542), so an attacker who can freely message it via BlueBubbles gains a foothold for social engineering or prompt injection against the agent itself, not just a messaging-layer nuisance. Patch to OpenClaw 2026.2.22+ and, in the interim, explicitly set a non-empty allowFrom allowlist on any BlueBubbles-integrated deployment — do not rely on the default configuration to fail closed.

Sources: NVD GitHub Advisory EPSS CISA KEV ATLAS vulncheck.com

What is the risk?

Medium severity by CVSS (6.5) but the practical risk is context-dependent: exploitation requires zero privileges and zero user interaction, making it trivially automatable against any exposed, misconfigured instance, yet the direct technical impact is limited to low-confidentiality/low-integrity message delivery. No CISA KEV listing, no public PoC, and no scanner template exist, and EPSS (0.00255, 83rd percentile) indicates low near-term mass-exploitation probability. The compounding risk factor is that OpenClaw is an AI agent — an unauthorized messaging channel is a plausible entry point for downstream prompt injection or social-engineering of the agent's decision-making, which is not captured by the CVSS score itself. Downstream blast radius is narrow (4 dependents, optional plugin only), which limits scale but not severity for affected organizations.

How does the attack unfold?

Initial Access

Attacker sends a direct message to a BlueBubbles-connected OpenClaw account, exploiting the empty allowFrom configuration to bypass the pairing/allowlist authorization check.

AML.T0049

Unauthorized Channel Access

The message is accepted as though it came from an authorized, paired sender, giving the attacker an open, unauthenticated communication channel to the agent.

AML.T0093

Manipulation Attempt

Attacker leverages the now-open channel to send crafted instructions attempting to socially engineer or prompt-inject the agent.

AML.T0051.000

Impact

Depending on the agent's connected tools and permissions, attacker-controlled messages could trigger unauthorized actions, data exposure, or further account compromise.

Initial Access

Attacker sends a direct message to a BlueBubbles-connected OpenClaw account, exploiting the empty allowFrom configuration to bypass the pairing/allowlist authorization check.

AML.T0049

Unauthorized Channel Access

The message is accepted as though it came from an authorized, paired sender, giving the attacker an open, unauthenticated communication channel to the agent.

AML.T0093

Manipulation Attempt

Attacker leverages the now-open channel to send crafted instructions attempting to socially engineer or prompt-inject the agent.

AML.T0051.000

Impact

Depending on the agent's connected tools and permissions, attacker-controlled messages could trigger unauthorized actions, data exposure, or further account compromise.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C Low

I Low

A None

What should I do?

1 step

Upgrade OpenClaw to version 2026.2.22 or later, which fixes the allowlist validation logic (see linked patch commits). Until patched, explicitly configure a non-empty allowFrom list naming only legitimate paired senders — do not leave the field empty or rely on defaults. Audit any BlueBubbles plugin configuration for this fail-open condition, and disable the plugin entirely if it is not actively required. Monitor BlueBubbles-connected agent logs for inbound messages from unrecognized or unpaired senders as a detection signal, and treat all inbound DM content as untrusted input subject to standard prompt-injection defenses regardless of allowlist status.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Prompt Injection Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0051.000 - Direct AML.T0093 - Prompt Infiltration via Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-22170?

OpenClaw's optional BlueBubbles plugin ships a dmPolicy pairing and allowlist mechanism meant to restrict who can message the agent, but when the allowFrom configuration is left empty that check fails open, letting any remote sender direct-message the agent without authorization. This is a network-exploitable, no-auth, no-user-interaction bug (CVSS 6.5, AC:L/PR:N/UI:N), so any deployment that left allowFrom unset is trivially reachable by an unauthenticated attacker, though the confidentiality/integrity impact is capped at 'low' and it's absent from CISA KEV, has no public exploit or Nuclei template, and sits at only the 83rd EPSS percentile with SSVC 'Track' — meaning opportunistic mass exploitation is unlikely today. The real concern is what this channel enables: OpenClaw is an autonomous agent with a documented history of acting on untrusted input (AIID #1368, #1471, #1542), so an attacker who can freely message it via BlueBubbles gains a foothold for social engineering or prompt injection against the agent itself, not just a messaging-layer nuisance. Patch to OpenClaw 2026.2.22+ and, in the interim, explicitly set a non-empty allowFrom allowlist on any BlueBubbles-integrated deployment — do not rely on the default configuration to fail closed.

Is CVE-2026-22170 actively exploited?

No confirmed active exploitation of CVE-2026-22170 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-22170?

Upgrade OpenClaw to version 2026.2.22 or later, which fixes the allowlist validation logic (see linked patch commits). Until patched, explicitly configure a non-empty allowFrom list naming only legitimate paired senders — do not leave the field empty or rely on defaults. Audit any BlueBubbles plugin configuration for this fail-open condition, and disable the plugin entirely if it is not actively required. Monitor BlueBubbles-connected agent logs for inbound messages from unrecognized or unpaired senders as a detection signal, and treat all inbound DM content as untrusted input subject to standard prompt-injection defenses regardless of allowlist status.

What systems are affected by CVE-2026-22170?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI agent plugin integrations, chat/messaging-triggered agents.

What is the CVSS score for CVE-2026-22170?

CVE-2026-22170 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.26%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI agent plugin integrationschat/messaging-triggered agents

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0051.000 Direct

AML.T0093 Prompt Infiltration via Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.22 with the optional BlueBubbles plugin contain an access control bypass vulnerability where empty allowFrom configuration causes dmPolicy pairing and allowlist restrictions to be ineffective. Remote attackers can send direct messages to BlueBubbles accounts by exploiting the misconfigured allowlist validation logic to bypass intended sender authorization checks.

Exploitation Scenario

An attacker identifies a target organization running OpenClaw with the BlueBubbles plugin enabled and a misconfigured (empty) allowFrom setting. The attacker sends a direct message to the paired iMessage/BlueBubbles-connected account; because the allowlist check silently passes on empty configuration, the message is accepted as though it came from an authorized, paired sender. With this unauthorized channel established, the attacker can attempt to socially engineer or prompt-inject the agent, potentially triggering unintended tool invocations, data exposure, or further compromise — a realistic escalation path given OpenClaw's documented history of acting on messages and instructions it should not have (AIID #1368, #1471, #1542).

Weaknesses (CWE)

CWE-863 Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.