| Package | Affected versions | Patched versions |
|---|---|---|
| openclaw | < 2026.4.20 | 2026.4.20 |
| openclaw | < 2026.4.20 | 2026.4.20 |
openclaw (npm)< 2026.4.202026.4.20Feishu card-action callbacks could synthesize a message event with DM conversations classified as group conversations. That skipped dmPolicy enforcement for card actions, so a sender in a Feishu DM could trigger card-action flows that should have been blocked by a restrictive DM policy.
The issue is limited to Feishu card-action handling. Severity is medium.
OpenClaw now resolves Feishu card-action chat type before dispatch, including API lookup when stored context is unavailable, and avoids falling through to group handling for DMs.
Fix commit:
90979d7c3ef7ec30b9f8aa6963a5e38d2f17d166Fixed in OpenClaw 2026.4.20.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free