Executive brief
OpenClaw is a messaging and routing platform that includes optional Matrix protocol support for direct messaging. When configured with Matrix plugin, an attacker can bypass access control allowlists by spoofing user identities using display names or incomplete user identifiers, potentially gaining unauthorized access to routing and agent pipelines.
Technical details
The vulnerability is an authentication/authorization bypass (CWE-287, CWE-290) in OpenClaw's Matrix direct message allowlist matching logic. The vulnerable component performs allowlist lookups by matching sender identities against multiple candidate values, including the attacker-controlled display name and the local part of the Matrix ID (ignoring the homeserver domain). This allows a remote Matrix user from any homeserver to impersonate an allowed identity if the allowlist is configured with bare localparts (e.g., "alice") or display names instead of full Matrix IDs (e.g., "@alice:trusted.example"). The attack requires no authentication or special privileges and is network-accessible. The practical impact depends on downstream routing and agent capabilities enabled in the deployment. Patched versions (2026.2.2 and later) enforce full Matrix ID matching.
Affected products
- OpenClaw OpenClaw >=2026.1.14-1, <2026.2.2
Timeline
- 2026-02-17: disclosed
- 2026-02-02: patched: Patch version 2026.2.2 released