OpenClaw clawdbot

• CVE-2026-26328 Medium 6.5 OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities 0.3%
• CVE-2026-26317 High 7.1 OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints 0.2%