Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix Unknown phone number appeared in OpenClaw allowFrom without user authorization [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#62339•Fetched 2026-04-08 03:05:46
View on GitHub
Comments
0
Participants
1
Timeline
2
Reactions
0
Author
kelvinisly-collabkelvinisly-collab
Participants
kelvinisly-collabkelvinisly-collab
Timeline (top)
labeled ×2

An unknown phone number appeared in the OpenClaw WhatsApp allowFrom configuration without user authorization, and the Eye Rest Reminder cron job sent messages to this unknown number.

Root Cause

An unknown phone number appeared in the OpenClaw WhatsApp allowFrom configuration without user authorization, and the Eye Rest Reminder cron job sent messages to this unknown number.

RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

An unknown phone number appeared in the OpenClaw WhatsApp allowFrom configuration without user authorization, and the Eye Rest Reminder cron job sent messages to this unknown number.

Steps to reproduce

  1. User has OpenClaw 2026.4.5 running with WhatsApp dmPolicy set to "allowlist"
  2. User has only 3 authorized phone numbers in allowFrom configuration
  3. On April 7, 2026, user discovered an unknown phone number in allowFrom
  4. User confirmed this number was never provided in any instructions to the AI
  5. User confirmed this number is not in their phone contacts
  6. User confirmed this number does not appear in any conversation records
  7. User confirmed they have never communicated with this number
  8. Eye Rest Reminder cron job sent messages to this unknown number on April 7, 2026 at 10:11

Expected behavior

The allowFrom configuration should only contain phone numbers explicitly authorized by the user. Unknown numbers should not appear without user consent. Cron jobs should only send messages to authorized numbers.

Actual behavior

An unknown phone number appeared in the allowFrom configuration without user authorization. The Eye Rest Reminder cron job sent messages to this unknown number on April 7, 2026 at 10:11. User confirmed this number was never provided in any instructions, is not in their contacts, and they have never communicated with this number.

OpenClaw version

2026.4.5

Operating system

Windows 11

Install method

npm global

Model

minimax/text-01

Provider / routing chain

openclaw -> minimax

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

Affected: OpenClaw users with WhatsApp dmPolicy=allowlist. Severity: High (security/privacy risk, unauthorized message delivery). Frequency: Observed once. Consequence: Messages sent to unauthorized phone numbers without user consent.

Additional information

This issue may be related to GitHub issue #20108 (allowFrom bypass bug). The unknown number appeared in allowFrom between April 6-7, 2026. The user had only 3 authorized numbers in allowFrom before this incident. This is a serious security/privacy concern.

extent analysis

TL;DR

Review and update the allowFrom configuration to remove the unknown phone number and consider temporarily disabling the Eye Rest Reminder cron job to prevent further unauthorized message deliveries.

Guidance

  • Investigate the allowFrom configuration update history to determine how the unknown number was added, potentially linking it to the reported allowFrom bypass bug (GitHub issue #20108).
  • Verify that the WhatsApp dmPolicy is correctly set to "allowlist" and that the minimax/text-01 model is properly configured to respect this policy.
  • Check for any recent updates or changes to the OpenClaw configuration, especially around April 6-7, 2026, that might have inadvertently allowed the unknown number to be added.
  • Consider implementing additional logging or auditing for changes to the allowFrom configuration to detect and prevent similar incidents in the future.

Example

No specific code snippet can be provided without more details on the OpenClaw configuration and the minimax/text-01 model implementation. However, ensuring that any updates to the allowFrom list are properly validated and authorized by the user is crucial.

Notes

The exact cause of the unknown number being added to the allowFrom configuration is not clear from the provided information. It is essential to investigate the configuration history and potential interactions with the minimax/text-01 model to understand and fix the root cause.

Recommendation

Apply a workaround by manually reviewing and updating the allowFrom configuration and temporarily disabling the Eye Rest Reminder cron job until the root cause is identified and fixed, to prevent further unauthorized message deliveries. This approach is chosen due to the high severity of the issue as a security/privacy risk.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

The allowFrom configuration should only contain phone numbers explicitly authorized by the user. Unknown numbers should not appear without user consent. Cron jobs should only send messages to authorized numbers.

#SSR setup#ISR setup#authentication setup#request error#file not found

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING