CyberRota Analysis
AI-GeneratedThe OpenClaw Matrix integration in versions 2026.2.2 to 2026.8.0 is vulnerable due to improper handling of case sensitivity in Matrix user IDs, allowing distinct accounts to normalize to the same authorization identity. This can enable an attacker to gain unauthorized access to permissions and authorities of other accounts, posing a significant risk to user security and data integrity. Organizations using affected versions should prioritize upgrading to 2026.8.1 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenClaw's Matrix integration (npm package @openclaw/matrix) versions >= 2026.2.2 and < 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and the case-sensitive server-name portion — when deriving the OpenClaw authorization identity. As a result, distinct authenticated Matrix accounts can normalize to the same authorization identity. A Matrix participant controlling a colliding account identifier (a protocol-valid identifier that differs from the configured one only by characters OpenClaw case/Unicode folds; display-name matching is not required) can inherit allowlist, owner-command, exec-approval, or plugin-approval authority configured for another account. The issue is fixed in 2026.8.1.