CVE-2026-100582: OpenClaw Channel Plugins Disclosure Flaw

CVE-2026-100582 Overview

CVE-2026-100582 affects OpenClaw channel plugins including @openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat before version 2026.8.1. The plugins fail to enforce the configured channel read allowlist when callers supply explicit read targets. A lower-trust sender or a steered agent can issue message, reaction, pin, member, and metadata read actions against channels excluded by the operator's read policy. The actual exposure depends on the permissions held by the connected bot account. The flaw is categorized as Missing Authorization [CWE-862] and is fixed in 2026.8.1.

Critical Impact
Attackers with access to any channel read action can retrieve content and metadata from channels the operator intended to exclude, bypassing the plugin's read allowlist entirely.

Affected Products

@openclaw/msteams before 2026.8.1
@openclaw/feishu before 2026.8.1
@openclaw/matrix and @openclaw/googlechat before 2026.8.1

Discovery Timeline

2026-09-26 - CVE-2026-100582 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100582

Vulnerability Analysis

The OpenClaw channel plugins expose read actions that accept caller-supplied channel or room identifiers as explicit read targets. These targets include messages, reactions, pins, member lists, and related metadata. The plugins do not validate those identifiers against the operator-configured read allowlist before forwarding the request to the underlying bot API. Any sender authorized to invoke a read action can therefore address channels outside the allowlist. In agent-driven deployments, a prompt-steered agent can be coerced into issuing the same out-of-scope reads. The resulting disclosure is bounded only by the connected bot account's native permissions in Microsoft Teams, Feishu, Matrix, or Google Chat.

Root Cause

The root cause is a missing authorization check [CWE-862]. The allowlist is consulted for implicit channel resolution but not for explicit, caller-supplied targets. This gap allows the authorization policy to be trivially bypassed by passing the target identifier directly in the action parameters.

Attack Vector

Exploitation requires network access and low privileges, with no user interaction. An authenticated lower-trust sender or an AI agent exposed to untrusted input invokes a standard read action and specifies a channel identifier outside the configured allowlist. The plugin forwards the request, and the bot returns the data if it holds the corresponding permission in the messaging platform.

No verified exploitation code is published. Refer to the GitHub Security Advisory GHSA-g7fw-3gjp-g5hf and the VulnCheck Advisory on OpenClaw for authoritative technical details.

Detection Methods for CVE-2026-100582

Indicators of Compromise

Bot API read requests targeting channel or room identifiers that do not appear in the OpenClaw plugin's configured read allowlist.
Unusual spikes in messages.read, members.list, pins.list, or reaction enumeration calls originating from the OpenClaw bot account.
Agent transcripts or tool-call logs containing explicit channel identifiers supplied by the user or an upstream model.

Detection Strategies

Correlate OpenClaw action invocations with the operator allowlist and alert when the requested target identifier is not a member of the configured set.
Review Microsoft Teams, Feishu, Matrix, and Google Chat audit logs for bot-initiated reads against channels the bot was not expected to access.
Inspect agent orchestration logs for prompt injection patterns that steer tool calls toward specific channel IDs.

Monitoring Recommendations

Enable verbose logging for all OpenClaw read actions, capturing caller identity, supplied parameters, and resolved target.
Forward messaging platform audit events to a central data lake and build baselines for bot account access patterns.
Alert on first-seen channel or room identifiers accessed by the OpenClaw bot account.

How to Mitigate CVE-2026-100582

Immediate Actions Required

Upgrade @openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat to version 2026.8.1 or later.
Audit the connected bot account permissions and remove access to channels that should not be reachable by the OpenClaw integration.
Review historical logs for read actions issued against channels outside the configured allowlist since the plugins were deployed.

Patch Information

The maintainers fixed the issue in OpenClaw channel plugin release 2026.8.1. The patched versions enforce the configured read allowlist for caller-supplied explicit read targets across message, reaction, pin, member, and related metadata read actions. See the GitHub Security Advisory GHSA-g7fw-3gjp-g5hf for upgrade guidance.

Workarounds

Restrict the bot account's channel memberships in the underlying messaging platform so it cannot read channels outside the intended scope.
Disable the affected channel read actions in the agent tool manifest until the upgrade to 2026.8.1 is complete.
Add an upstream policy layer that validates channel identifiers in tool-call parameters against the operator allowlist before invoking OpenClaw.

bash

# Upgrade the affected OpenClaw channel plugins
npm install @openclaw/msteams@2026.8.1
npm install @openclaw/feishu@2026.8.1
npm install @openclaw/matrix@2026.8.1
npm install @openclaw/googlechat@2026.8.1