Executive Summary

This vulnerability exists in OpenClaw versions before 2026.5.6 and involves a configuration enforcement bypass in the Feishu dynamic-agent bindings feature.

Specifically, authenticated senders can create or update bindings without the system enforcing the configured config-write controls, meaning the intended restrictions on modifying bindings are not properly applied.

Attackers can exploit this flaw by using the dynamic-agent binding feature to change the sender-agent binding state beyond what the policy intends, potentially allowing unauthorized modifications.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows attackers with authentication to bypass configuration controls and modify sender-agent bindings in ways not intended by policy.

This could lead to unauthorized changes in the system's binding state, potentially undermining security policies and allowing actions that should be restricted.

While the impact is limited by the need for authentication, it still poses a risk of unauthorized configuration changes that could affect system behavior or security posture.

Useful 0 Not Useful 0