OpenClaw CVE-2026-100582

Exploitation requires: (1) an operator has configured a channel read allowlist/read policy that is supposed to exclude certain channels or rooms; (2) the attacker already holds low-privilege access to a channel read action in one of the affected plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, or @openclaw/googlechat before 2026.8.1) - either as a lower-trust sender or as a steered/prompt-injected agent; and (3) the attacker supplies an explicit read target (channel/room ID) for message, reaction, pin, member, or related metadata read actions. Limiting factors: the flaw only matters when a restrictive read allowlist is actually configured (default open policies expose nothing new), and the amount of retrievable content is strictly bounded by the permissions of the connected bot account, so a least-privilege bot sharply reduces impact.

Signals are internally consistent and point to a genuine but bounded confidentiality issue rather than a top-tier priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, base 7.1) describes a network-reachable, low-complexity flaw requiring low privilege with no user interaction, and impact limited to confidentiality (VC:H, integrity/availability N) - matching the CWE-862 Missing Authorization root cause of an unenforced channel read allowlist. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation is: no public exploit identified at time of analysis. Two factors dampen real-world risk despite the network vector: the attacker must already be a lower-trust sender or a steered agent with an existing channel read action (PR:L, not PR:N), and the practical blast radius is explicitly capped by the permissions of the connected bot account - a tightly-scoped bot yields little exposed data. Note the input Tag 'Authentication Bypass' conflicts with the actual weakness (CWE-862 is an authorization/allowlist-enforcement failure, not authentication bypass); treat this as a policy-enforcement bug. Overall: a real defense-in-depth gap worth patching to 2026.8.1, but the niche product footprint and authenticated precondition make it a moderate, not urgent, priority.

An operator configures a read allowlist so the OpenClaw bot may only read approved channels, but a lower-trust user (or an agent manipulated via prompt injection) issues a message/reaction/pin/member read action naming an explicit channel or room ID outside that allowlist. Because the plugin never checks the caller-supplied target against the policy, it returns content and metadata from the excluded channel, limited only by what the bot account itself can access. No public exploit code is known, and the action requires existing low-privilege access to a channel read capability.