CVE-2026-100582: OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass
OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-trust sender or a steered agent with access to a channel read action can therefore retrieve content or metadata from channels or rooms excluded by the operator's read policy; the practical impact depends on the permissions held by the connected bot account. The issue is fixed in 2026.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat)to a version that resolves this vulnerability.Fixed in 2026.8.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using @openclaw/msteams, @openclaw/feishu, @openclaw/matrix, or @openclaw/googlechat before 2026.8.1 are affected when channel read actions are available and a channel read allowlist is configured. The actual data exposed depends on the permissions of the connected bot account.
What does an attacker need to exploit this issue?
A lower-trust sender, or an agent steered by one, needs access to a channel read action and must be able to supply an explicit read target. No user interaction is required.
Does configuring a channel read allowlist prevent exploitation?
No. Before 2026.8.1, the affected plugins do not enforce that allowlist for caller-supplied explicit targets in message, reaction, pin, member, and related metadata read actions.
What should be done if an immediate upgrade is not possible?
Restrict access to channel read actions and limit the connected bot account's permissions to only the channels and metadata it must access. This reduces the content and metadata available through an allowlist bypass.
How can I determine whether I am affected?
Check whether any listed channel plugin is running a version earlier than 2026.8.1, whether channel read actions can be invoked by lower-trust senders or steered agents, and whether the connected bot account can read channels excluded by the configured allowlist.