OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2026.8.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-trust sender or a steered agent with access to a channel read action can therefore retrieve content or metadata from channels or rooms excluded by the operator's read policy; the practical impact depends on the permissions held by the connected bot account. The issue is fixed in 2026.8.1.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- openclaw msteams
fixed in 2026.8.1
- openclaw feishu
fixed in 2026.8.1
- openclaw matrix
fixed in 2026.8.1
- openclaw googlechat
fixed in 2026.8.1
- @openclaw/msteamsnpm
fixed in 2026.8.1
- @openclaw/feishunpm
fixed in 2026.8.1
- @openclaw/matrixnpm
fixed in 2026.8.1
- @openclaw/googlechatnpm
fixed in 2026.8.1