CVE-2026-28448 is an authorization bypass in the OpenClaw Twitch plugin. When allowedRoles is unset or empty, the allowFrom allowlist is not enforced, so any Twitch user who mentions the bot can trigger the agent. NVD scores it 7.3. Upgrade openclaw to 2026.2.1 or later.
What's affected
The GitHub advisory GHSA-33rq-m5x2-fvgf lists affected versions 2026.1.29 up to but not including 2026.2.1 and patched versions 2026.2.1 and later of the npm package openclaw.
The scope is the optional Twitch plugin only. Core installs that do not install and enable the plugin are not impacted. Within the plugin, the exposure applies when an allowFrom list is configured but allowedRoles is unset or empty.
The advisory rates it High at 7.3 with network access and no privileges. The weakness is CWE-285 (Improper Authorization).
How to check if you're exposed
Check the OpenClaw version in each project and global install.
npm ls openclaw
npm ls -g openclaw
Then check whether the Twitch plugin is installed and enabled, and read its access control settings. A configuration with allowFrom set and allowedRoles empty is the one the advisory describes.
What to do now
- Upgrade openclaw to 2026.2.1 or later. The advisory's workaround is the upgrade.
- Review the Twitch plugin's settings and set allowedRoles deliberately.
- Check which tools and models the agent can reach from Twitch chat, and limit them.
- Set usage limits on the model account behind the bot so open access cannot run up costs.
- Review chat logs for messages from users who were not on your allowFrom list.
Why it matters
The documented behaviour was a hard allowlist. The code returned allowed for members of the list but did not return denied for non-members, so execution fell through to the next check. If allowedRoles was empty, that check allowed everyone.
This is a missing else branch, one of the most common authorization mistakes. The fix is to make denial the default and require every path to opt in to allowing.
The impact the advisory lists is unintended actions or responses and resource or cost exhaustion. A public chat room is an easy place for a stranger to find a bot, and every message that reaches an agent can cost money and may trigger tool use.
The record does not flag exploitation in the wild, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Do I need the fix if I never installed the Twitch plugin?
No. The advisory says core installs without the plugin are not impacted.
What is the safe default for access control code?
Deny unless a rule allows. The bug existed because a failing check fell through to a default that allowed.
Sources
Last reviewed: 19 October 2026.
