CVE-2026-100541 openclaw CVE debrief

Who should care

Defenders responsible for OpenClaw Matrix integration deployments should assess exposure and prioritize remediation due to the potential for authorization bypass and unintended access to sensitive permissions.

Why it matters

CVE-2026-100541 is a high-severity vulnerability in OpenClaw's Matrix integration that can lead to authorization bypass and unintended access to sensitive permissions. Defenders should prioritize verifying and updating OpenClaw Matrix integration versions to 2026.8.1 or later, and review authorization configurations for potential vulnerabilities.

• Potential unauthorized access to sensitive permissions
• Possible elevation of privileges for Matrix participants controlling colliding account identifiers
• Need for verification and updates to OpenClaw Matrix integration versions
• Potential for exploitation through crafted Matrix user IDs

Technical summary

OpenClaw's Matrix integration (npm package @openclaw/matrix) versions >= 2026.2.2 and < 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and the case-sensitive server-name portion — when deriving the OpenClaw authorization identity. As a result, distinct authenticated Matrix accounts can normalize to the same authorization identity. A Matrix participant controlling a colliding account identifier can inherit allowlist, owner-command, exec-approval, or plugin-approval authority configured for another account.

Defensive priority

Defenders should prioritize verifying and updating OpenClaw Matrix integration versions to 2026.8.1 or later, and review authorization configurations for potential vulnerabilities.

Recommended defensive actions

• Verify and update OpenClaw Matrix integration to version 2026.8.1 or later
• Review authorization configurations for potential vulnerabilities
• Monitor for suspicious activity related to Matrix user IDs and authorization
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the case folding of Matrix user IDs in OpenClaw's Matrix integration, which can lead to authorization bypass. The issue is fixed in version 2026.8.1. Evidence is based on the official CVE record and NVD detail page. The vulnerability has a high severity score of 7.7 and is classified as HIGH. The CVE record was published on 2026-09-26T03:16:59.987Z and has not been modified since then. The OpenClaw Matrix integration versions >= 2026.2.2 and < 2026.8.1 are affected, and defenders should verify and update

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.