CVE-2026-41376CWE-346

OpenClaw < 2026.3.31 - Matrix Thread Context Allowlist Bypass via Sender Validation

Low · published April 28, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
16.5
In the wild
Unconfirmed
What it is

OpenClaw before 2026.3.31 contains an allowlist bypass vulnerability in Matrix thread root and reply context handling that fails to properly validate message senders. Attackers can fetch thread-root and reply context messages that should be filtered by sender allowlists, bypassing access controls.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00258 · 16.5th percentile
Weakness
CWE-346 · Origin Validation Error
Published
2026-04-28T18:09Z
EPSS history
Timeline
  • 28 APR 18:09Z
    OpenClaw < 2026.3.31 - Matrix Thread Context Allowlist Bypass via Sender Validation
    cvelistv5