OpenClaw Matrix CVE-2026-100541

Requires the OpenClaw Matrix integration (@openclaw/matrix, versions >=2026.2.2 and <2026.8.1) deployed with account-based authority controls - an allowlist, owner-command, exec-approval, or plugin-approval configuration keyed to a specific Matrix account. The attacker must hold a valid, authenticated Matrix account AND be able to control a protocol-valid Matrix user identifier that differs from the configured privileged one only in characters OpenClaw case/Unicode-folds (e.g. server-name case or foldable localpart); display-name matching is not required. Limiting factors: PR:L means the attacker needs an authenticated Matrix identity, AC:H/AT:P mean a specific colliding identifier must exist and be registrable, and installations that do not configure per-account authority for the Matrix bridge are not meaningfully exposed. No user interaction by a victim is required (UI:N).

This is a genuine authorization-bypass flaw whose real-world risk is moderate and gated by several conditions rather than a spray-and-pray threat. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H) is internally consistent with the description: network-reachable via Matrix, but AC:H and AT:P reflect that the attacker must control a Matrix identifier that case/Unicode-folds to the configured owner/allowlisted account, and PR:L reflects that the attacker must first hold a valid authenticated Matrix account. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis' - this is not confirmed in-the-wild activity. The high VC/VI/VA impact is credible because a colliding identity inherits owner-command, exec-approval, and plugin-approval authority, which on an agent framework translates to command execution, not mere data exposure. The primary conflicting signal is the input Tags labeling this 'Information Disclosure', which understates the true impact: inheriting exec-approval authority is an integrity/execution outcome, matching the VI:H/VA:H the vendor itself assigned. Net: elevated-but-conditional priority for anyone actually running the OpenClaw Matrix bridge with allowlist/owner controls; low urgency for the general population given the niche product and absence of exploitation evidence.

An attacker registers or controls a Matrix account whose user ID differs from a privileged (owner/allowlisted) account only by characters that OpenClaw folds - e.g. differing letter case in the server-name portion or a Unicode-foldable localpart. When that attacker interacts with the OpenClaw bot, its identity-derivation lowercases/folds the ID so it collides with the configured privileged account, and the attacker inherits owner-command, exec-approval, and plugin-approval authority. No public proof-of-concept is referenced, and success requires the attacker to already hold a valid Matrix account and craft a colliding-but-valid identifier (AC:H/AT:P/PR:L).