Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenClaw versions 2026.1.29 prior to 2026.2.1 contain a vulnerability in the Twitch plugin (must be installed and enabled) in which it fails to enforce the allowFrom allowlist when allowedRoles is unset or empty, allowing unauthorized Twitch users to trigger agent dispatch. Remote attackers can mention the bot in Twitch chat to bypass access control and invoke the agent pipeline, potentially causing unintended actions or resource exhaustion.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-28448 OpenClaw versions 2026.1.29 prior to 2026.2.1 contain a vulnerability in the Twitch plugin (must be installed and enabled) in which it fails to enforce the allowFrom … https://www.cve.org/CVERecord?id=CVE-2026-28448
Post summary
CVE-2026-28448 highlights a vulnerability in OpenClaw’s Twitch plugin that fails to enforce allowFrom restrictions in versions prior to 2026.2.1.
CVE Alert: CVE-2026-28448 - OpenClaw - OpenClaw - https://www.redpacketsecurity.com/cve-alert-cve-2026-28448-openclaw-openclaw/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-28448 #openclaw #
Post summary
The post is a CVE alert announcing CVE-2026-28448 in OpenClaw, linking to an external security advisory page.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openclaw | openclaw | - | node.js | - |