# GHSA-chm2-m3w2-wcxm: OpenClaw Google Chat spoofing access with allowlist authorized mutable email principal despite sender-ID mismatch

> Attackers with administrative control over identity lifecycle can bypass Google Chat allowlists by exploiting mutable email principal matching.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** An administrator
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 17 Feb 2026

## What is GHSA-chm2-m3w2-wcxm?

GHSA-chm2-m3w2-wcxm is an authentication bypass vulnerability in clawdbot, published on 17 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.

### Official description

### Summary
Google Chat allowlisting supports matching by sender email in addition to immutable sender resource name (`users/<id>`). This weakens identity binding if a deployment assumes allowlists are strictly keyed by immutable principals.

### Affected Packages / Versions
(As of 2026-02-14; based on latest published npm versions)
- `openclaw` (npm): `<= 2026.2.13`
- `clawdbot` (npm): `<= 2026.1.24-3`

### Details
Affected component:
- `extensions/googlechat/src/monitor.ts`

The `allowFrom` checks accept:
- Immutable sender id (`users/<id>`)
- Raw email (`alice@example.com`) for usability

Historically, `users/<email>` was also treated as an email allowlist entry. This is now deprecated because it looks like an immutable ID but is actually a mutable principal.

### Security Triage (2026-02-14)
Severity: **Low**

Rationale:
- Requests are authenticated as coming from Google Chat (token verification), so this is not a generic unauthenticated spoofing vector.
- A realistic exploit generally requires **Google Workspace / IdP administrative control** over identity lifecycle (e.g. reassigning an email address to a different underlying account) to obtain the same email with a different `users/<id>`.
- With that level of access, the attacker typically has broader compromise paths.

We still treat it as a valid defense-in-depth report because accepting mutable principals in authorization decisions can increase risk in chained-failure scenarios.

### Remediation / Behavior Changes
Goal: preserve usability while reducing footguns.
- Raw email allowlists remain supported.
- `users/<email>` is deprecated and treated as a **user id**, not as an email allowlist.
- Documentation recommends `users/<id>` when strict immutable binding is required.

### Fix Commit(s)
- `c8424bf29a921e25663b29f308640b3d91a49432` (PR #16243)

Thanks @vincentkoc for reporting.

## Which versions are affected by GHSA-chm2-m3w2-wcxm?

4 open source packages ship an affected version, including clawdbot and openclaw.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `clawdbot` | npm | All versions to 2026.1.24-3 | None |
| `clawdbot` | npm | All versions to 2026.1.24-3 | None |
| `openclaw` | npm | All versions | 2026.2.14 |
| `openclaw` | npm | All versions | 2026.2.14 |

## How do I fix GHSA-chm2-m3w2-wcxm?

Apply the vendor's patch.

## Is GHSA-chm2-m3w2-wcxm being exploited?

There is no known exploitation of GHSA-chm2-m3w2-wcxm in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-chm2-m3w2-wcxm and fix it if it is affected.

What it is: GHSA-chm2-m3w2-wcxm is an authentication bypass vulnerability in clawdbot, published on 17 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-chm2-m3w2-wcxm in the wild and no public exploit code.

Affected packages and fixed versions:
- clawdbot (npm): affected all versions up to 2026.1.24-3; no fix listed
- clawdbot (npm): affected all versions up to 2026.1.24-3; no fix listed
- openclaw (npm): affected all versions; fixed in 2026.2.14
- openclaw (npm): affected all versions; fixed in 2026.2.14

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-chm2-m3w2-wcxm/ (Markdown: https://insights.sbomify.com/GHSA-chm2-m3w2-wcxm/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-chm2-m3w2-wcxm

---
From sbomify Insights: https://insights.sbomify.com/GHSA-chm2-m3w2-wcxm/
Summaries are generated and may contain mistakes; the official description above is the record.