6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-rmxw-jxxx-4cpc

GHSA-rmxw-jxxx-4cpc: OpenClaw has a Matrix allowlist bypass via displayName and cross-homeserver localpart matching

Summary

OpenClaw Matrix DM allowlist matching could be bypassed in certain configurations.

Matrix support ships as an optional plugin (not bundled with the core install), so this only affects deployments that have installed and enabled the Matrix plugin.

Affected Packages / Versions

Package: openclaw (npm)
Affected: >= 2026.1.14-1, < 2026.2.2
Patched: >= 2026.2.2

Details

In affected versions, DM allowlist decisions could be made by exact-matching channels.matrix.dm.allowFrom entries against multiple sender-derived candidates, including:

The sender display name (attacker-controlled and non-unique)
The sender MXID localpart with the homeserver discarded, so @alice:evil.example and @alice:trusted.example both match alice

If an operator configured channels.matrix.dm.allowFrom with display names or bare localparts (for example, "Alice" or "alice"), a remote Matrix user may be able to impersonate an allowed identity for allowlist purposes and reach the routing/agent pipeline.

Impact

Matrix DM allowlist identity confusion. The practical impact depends on your Matrix channel policies and what capabilities are enabled downstream.

Mitigation

Upgrade to openclaw >= 2026.2.2.
Ensure Matrix allowlists contain only full Matrix user IDs (MXIDs) like @user:server (or *). Do not use display names or bare localparts.

Fix Commit(s)

8f3bfbd1c4fb967a2ddb5b4b9a05784920814bcf

Release Process Note

The patched version is already published to npm; the advisory can be published once you're ready.

Thanks @MegaManSec (https://joshua.hu) of AISLE Research Team for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-rmxw-jxxx-4cpc

GHSA-rmxw-jxxx-4cpc:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	>= 2026.1.14-1, < 2026.2.2	2026.2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-rmxw-jxxx-4cpc, is an authentication bypass in the OpenClaw Matrix plugin's Direct Message (DM) allowlist feature. The root cause was improper and weak validation of a sender's identity. The analysis of the patch 8f3bfbd1c4fb967a2ddb5b4b9a05784920814bcf reveals several key functions involved.

The primary vulnerable function is resolveMatrixAllowListMatch in extensions/matrix/src/matrix/monitor/allowlist.ts. Before the patch, this function would check the allowlist against a list of candidates that included not only the sender's full, unique Matrix ID (MXID) but also their non-unique, user-controlled display name and the 'localpart' of their MXID (the part before the colon). This allowed an attacker to impersonate an allowed user by either setting their display name to match an entry in the allowlist or by creating a user on a different homeserver with the same localpart.

The function createMatrixRoomMessageHandler in extensions/matrix/src/matrix/monitor/handler.ts is the entry point that processes incoming messages. It would fetch the sender's profile, including their display name, and pass this information to resolveMatrixAllowListMatch, thereby triggering the vulnerable check.

Additionally, the resolveMatrixTargets function in extensions/matrix/src/resolve-targets.ts contributed to the issue at configuration time. It would resolve display names to MXIDs for the allowlist, but if a name was ambiguous (matched multiple users), it would insecurely pick the first match. This could lead to an administrator unintentionally creating an insecure allowlist.

The patch rectifies these issues by removing the display name and localpart from the list of candidates in resolveMatrixAllowListMatch, ensuring that checks are only performed against the full, verified MXID. It also hardens resolveMatrixTargets to only resolve names that have a unique and exact match.

Vulnerable functions

resolveMatrixAllowListMatch

extensions/matrix/src/matrix/monitor/allowlist.ts

This function was the core of the vulnerability. It incorrectly used the sender's display name (`userName`) and the local part of their Matrix ID (`localPart`) as candidates for an allowlist check. Since both of these can be non-unique or attacker-controlled, it allowed an attacker to bypass the allowlist by impersonating a legitimate user's display name or by registering a user with the same localpart on a malicious homeserver.

createMatrixRoomMessageHandler

extensions/matrix/src/matrix/monitor/handler.ts

This function handles incoming Matrix messages. It was responsible for fetching the sender's profile, which includes the potentially malicious display name (`senderName`), and passing it to the vulnerable `resolveMatrixAllowListMatch` function for the authorization check. This function would be present in any runtime profile or stack trace when the vulnerability is triggered by an incoming DM.

resolveMatrixTargets

extensions/matrix/src/resolve-targets.ts

This function resolves user display names to Matrix IDs during the initial configuration setup. The vulnerable version would insecurely resolve ambiguous display names that matched multiple users by simply picking the first result. This could lead an administrator to inadvertently create a faulty allowlist rule. The patch corrects this by enforcing that a name must have a single, exact match to be resolved, preventing such ambiguity.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.5

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-rmxw-jxxx-4cpc: OpenClaw has a Matrix allowlist bypass via displayName and cross-homeserver localpart matching

Summary

Affected Packages / Versions

Details

Impact

Mitigation

Fix Commit(s)

Release Process Note

GHSA-rmxw-jxxx-4cpc:

6.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

GHSA-rmxw-jxxx-4cpc: OpenClaw has a Matrix allowlist bypass via displayName and cross-homeserver localpart matching

Summary

Affected Packages / Versions

Details

Impact

Mitigation

Fix Commit(s)

Release Process Note

Basic Information

Basic Information

6.5

6.5

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI