CVE-2026-41376: OpenClaw < 2026.3.31 - Matrix Thread Context Allowlist Bypass via Sender Validation
OpenClaw before 2026.3.31 contains an allowlist bypass vulnerability in Matrix thread root and reply context handling that fails to properly validate message senders. Attackers can fetch thread-root and reply context messages that should be filtered by sender allowlists, bypassing access controls.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41376?
CVE-2026-41376 is rated as a critical vulnerability due to the potential for unauthorized access to thread-root and reply context by attackers.
How do I fix CVE-2026-41376?
To fix CVE-2026-41376, update OpenClaw to version 2026.3.31 or later.
What systems are affected by CVE-2026-41376?
CVE-2026-41376 affects all versions of OpenClaw prior to 2026.3.31.
What type of vulnerability is CVE-2026-41376?
CVE-2026-41376 is an allowlist bypass vulnerability related to message sender validation in thread context handling.
What is the impact of CVE-2026-41376?
The impact of CVE-2026-41376 allows attackers to fetch sensitive thread-root and reply context information, potentially leading to further exploitation.