CVE-2026-44993: OpenClaw < 2026.4.20 - Direct Message Misclassification in Feishu Card Actions

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-11 · updated 2026-06-17
Weakness: CWE-184

Description

OpenClaw before 2026.4.20 contains a message classification vulnerability in Feishu card-action callbacks that misclassifies direct messages as group conversations. Attackers can bypass dmPolicy enforcement by triggering card-action flows in direct message conversations that should have been blocked by restrictive policies.

Affected products

OpenClaw: before 2026.4.20 — fixed in 2026.4.20

How to fix

Upgrade to a fixed version: OpenClaw 2026.4.20. Check the vendor advisory for mitigations.

References

https://github.com/openclaw/openclaw/commit/90979d7c3ef7ec30b9f8aa6963a5e38d2f17d166
https://github.com/openclaw/openclaw/security/advisories/GHSA-72q8-jcmc-97wx
https://www.vulncheck.com/advisories/openclaw-direct-message-misclassification-in-feishu-card-actions

Get alerted when CVE-2026-44993 or the next vulnerability affects your stack