CVE-2026-41376: OpenClaw Auth Bypass Vulnerability

CVE-2026-41376 Overview

CVE-2026-41376 is an authorization bypass vulnerability in OpenClaw before version 2026.3.31 affecting Matrix thread root and reply context handling. The vulnerability exists due to improper validation of message senders, allowing attackers to fetch thread-root and reply context messages that should be filtered by sender allowlists. This bypass enables unauthorized access to messages that were intended to be restricted based on sender identity.

Critical Impact

Attackers can bypass sender allowlist access controls to retrieve Matrix thread context messages from unauthorized senders, potentially exposing private communications.

Affected Products

• OpenClaw versions prior to 2026.3.31
• OpenClaw Matrix extension with thread context handling
• OpenClaw deployments with sender allowlist configurations

Discovery Timeline

• 2026-04-28 - CVE CVE-2026-41376 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41376

Vulnerability Analysis

This vulnerability is classified under CWE-346 (Origin Validation Error), which occurs when software does not properly verify that the source of data or communication is valid. In the context of OpenClaw's Matrix extension, the thread context retrieval mechanism fails to apply sender allowlist filtering when fetching reply-to messages and thread root content.

The flaw allows an attacker to retrieve message context that should be restricted by sender-based access controls. When the Matrix monitor processes thread replies, it fetches contextual information including the original message body and sender details. However, the allowlist validation was not being applied to these fetched context messages, creating a bypass condition where messages from blocked or unauthorized senders could still be retrieved through the thread context mechanism.

Root Cause

The root cause lies in missing allowlist validation logic in the Matrix monitor's reply context handler. The resolveMatrixAllowListMatch function was not being invoked when fetching room context for thread replies. The reply context data structure lacked the necessary sender ID field (replyToSenderId) required for proper allowlist validation against the original message sender.

Attack Vector

The attack vector is network-based, requiring an attacker to interact with a Matrix room where OpenClaw is deployed. The attacker can exploit this by:

1. Identifying a Matrix room with OpenClaw monitoring and sender allowlist restrictions
2. Creating or replying to threads that reference messages from restricted senders
3. Retrieving thread context that includes message content and sender information that should have been filtered

The vulnerability requires some user interaction and specific preconditions to be met, making exploitation more targeted rather than opportunistic.

// Security patch adding allowlist import in handler.ts
// Source: https://github.com/openclaw/openclaw/commit/8a563d603b70ef6338915f0527bee87282c3bad5

 } from "../send.js";
 import { resolveMatrixMonitorAccessState } from "./access-state.js";
 import { resolveMatrixAckReactionConfig } from "./ack-config.js";
+import { resolveMatrixAllowListMatch } from "./allowlist.js";
 import type { MatrixInboundEventDeduper } from "./inbound-dedupe.js";
 import { resolveMatrixLocation, type MatrixLocationPayload } from "./location.js";
 import { downloadMatrixMedia } from "./media.js";

// Security patch adding sender ID tracking in reply-context.ts
// Source: https://github.com/openclaw/openclaw/commit/8a563d603b70ef6338915f0527bee87282c3bad5

 export type MatrixReplyContext = {
   replyToBody?: string;
   replyToSender?: string;
+  replyToSenderId?: string;
 };

 function truncateReplyBody(value: string): string {

Detection Methods for CVE-2026-41376

Indicators of Compromise

• Unusual patterns of thread context retrieval for messages from senders not on the allowlist
• Log entries showing reply context fetches that bypass normal sender filtering
• Access to message content from restricted senders appearing in thread context responses

Detection Strategies

• Monitor OpenClaw logs for thread context requests that return data from senders not matching configured allowlists
• Audit Matrix room event logs for anomalous reply context retrieval patterns
• Implement alerting on any discrepancy between allowlist configurations and actual message access patterns

Monitoring Recommendations

• Enable verbose logging for Matrix monitor handler operations to track context retrieval activity
• Review access logs for the reply-context.ts and handler.ts components for unexpected behavior
• Deploy network monitoring to detect unusual Matrix API interactions with the OpenClaw instance

How to Mitigate CVE-2026-41376

Immediate Actions Required

• Upgrade OpenClaw to version 2026.3.31 or later immediately
• Review sender allowlist configurations to ensure they are properly defined
• Audit historical logs for potential exploitation of this vulnerability prior to patching

Patch Information

The security patch is available in OpenClaw version 2026.3.31 and later. The fix adds the resolveMatrixAllowListMatch import to the handler module and introduces the replyToSenderId field to the MatrixReplyContext type, enabling proper sender validation for fetched thread context. For detailed patch information, see the GitHub Security Advisory and commit 8a563d60.

Workarounds

• Temporarily disable thread context fetching in Matrix monitor configurations if patching is not immediately possible
• Implement additional network-level access controls to restrict Matrix API access to trusted sources
• Consider disabling the Matrix extension entirely until the patched version can be deployed

# Verify OpenClaw version after upgrade
openclaw --version
# Expected output: 2026.3.31 or higher

# Review Matrix extension configuration
cat /etc/openclaw/matrix/config.yaml | grep -A5 "allowlist"