GHSA-rg8m-3943-vm6qLowCVSS 6.5

OpenClaw: Matrix thread root and reply context bypass sender allowlist

Published
April 2, 2026
Last Modified
May 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-41376 →

📋 Description

Summary

Matrix thread root and reply context bypass sender allowlist

Current Maintainer Triage

  • Status: open
  • Normalized severity: medium
  • Assessment: Real in shipped v2026.3.28 Matrix because fetched thread-root/reply context bypasses sender allowlists, with unreleased mainline filtering fix.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Latest published npm version: 2026.3.31
  • Vulnerable version range: <=2026.3.28
  • Patched versions: >= 2026.3.31
  • First stable tag containing the fix: v2026.3.31

Fix Commit(s)

  • 8a563d603b70ef6338915f0527bee87282c3bad5 — 2026-03-31T17:09:03+01:00

OpenClaw thanks @AntAISecurityLab for reporting.

🎯 Affected products1

  • npm/openclaw:<= 2026.3.28

🔗 References (6)