Executive brief
OpenClaw is a plugin framework that integrates with Mattermost messaging platform to handle automated events. When Mattermost event messages lack channel type metadata, the application fails to enforce intended data protection policies for direct messages, potentially allowing crafted messages to bypass security restrictions. This could expose sensitive communications or allow unauthorized content processing depending on the operator's configuration.
Technical details
The vulnerability is an improper access control flaw (CWE-636) in OpenClaw's Mattermost event handlers that fail to validate channel type information before processing events. Attackers can craft Mattermost events with missing channel type metadata to bypass the intended direct message (DM) policy decision logic. The attack requires network reachability to the affected Mattermost instance but no authentication, and exploits a conditional logic gap where missing metadata causes policy enforcement to be skipped. The vulnerability is addressed in version 2026.5.6 and later.
Affected products
- OpenClaw openclaw <=2026.5.5
Timeline
- 2026-05-28: disclosed
- 2026-05-28: patched: Version 2026.5.6 released
- 2026-06-13: advisory
- 2026-08-28: other: GHSA-chqm-wxm2-w73w withdrawn as duplicate of GHSA-gp79-m99v-gjmh