GitHub Advisoryadvisory · npm

GHSA-rg8m-3943-vm6q OpenClaw: Matrix thread root and reply context bypass sender allowlist

LOW Published 2026-04-02 Modified 2026-05-06 Official page ↗
Aliases
CVE-2026-41376
Ecosystem
npm
Packages
openclaw
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-346, CWE-863
Reviewed
2026-04-02

Affected packages

• npm openclaw: < 2026.3.31 → fixed in 2026.3.31

Description

Summary Matrix thread root and reply context bypass sender allowlist Current Maintainer Triage • Status: open • Normalized severity: medium • Assessment: Real in shipped v2026.3.28 Matrix because fetched thread-root/reply context bypasses sender allowlists, with unreleased mainline filtering fix. Affected Packages / Versions • Package: `openclaw` (npm) • Latest published npm version: `2026.3.31` • Vulnerable version range: `= 2026.3.31` • First stable tag containing the fix: `v2026.3.31` Fix Commit(s) • `8a563d603b70ef6338915f0527bee87282c3bad5` — 2026-03-31T17:09:03+01:00 OpenClaw thanks @AntAISecurityLab for reporting.

Related

Alias · CVE (1)

  • CVE-2026-41376 OpenClaw before 2026.3.31 contains an allowlist bypass vulnerability in Matrix thread root and reply context handling that fails to… vulnerability

Weakness · CWE (2)

  • CWE-346 Origin Validation Error weakness
  • CWE-863 Incorrect Authorization weakness

References