Executive brief
OpenClaw is a library that facilitates integrations with the Mattermost messaging platform. A security flaw was found where interactive callback actions could be executed before the system verified if the sender was authorized. This could allow unauthorized users to trigger actions within the Mattermost integration, potentially leading to unauthorized data modification or service disruption.
Technical details
An improper authorization vulnerability (CWE-285) exists in the OpenClaw npm package's Mattermost extension. The root cause is an incorrect behavior order (CWE-696) where interactive callback dispatchers in 'interactions.ts' could execute action handlers before the sender authorization checks in 'monitor.ts' were completed. A remote, unauthenticated attacker can exploit this by sending crafted callback requests to trigger actions that should be restricted to allowlisted senders. This can result in unauthorized integrity and availability impacts on the integrated Mattermost environment. The issue is fixed in version 2026.3.22 by enforcing authorization before action dispatch.
Affected products
- OpenClaw openclaw < 2026.3.22
Timeline
- 2026-03-24: disclosed: Initial disclosure in openclaw/openclaw repository
- 2026-03-26: advisory: GitHub Advisory GHSA-8883-9w57-vwv6 published
- 2026-03-22: patched: Fix released in version 2026.3.22
- 2026-04-10: other: NVD published CVE-2026-35652