CVE-2026-28471: Openclaw OpenClaw Has A Matrix Allowlist Vulnerability
MODERATECVE-2026-28471 is a MODERATE (CVSS 6.5) openclaw has a matrix allowlist vulnerability (CWE-287: Improper Authentication) affecting Openclaw libraries in the npm ecosystem. The issue involves openclaw has a matrix allowlist bypass via displayname and cross-homeserver localpart matching. Remediation is available by upgrading affected packages to version 2026.2.2.
CVE-2026-28471 at a Glance
Security Impact
CVSS: 6.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
How to Fix CVE-2026-28471
To remediate this vulnerability, upgrade all affected Openclaw dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install openclaw@2026.2.2Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls openclawHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-28471, inspect your project dependencies using npm:
npm ls openclawAnalyze the terminal output to locate any version of Openclaw in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2026.2.2), your application is affected.
Note: The npm ls openclaw command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-287: Improper Authentication, where when an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. In Openclaw, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-28471 Affected Openclaw Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
openclaw
|
npm |
≥ 2026.1.14-1
< 2026.2.2
|
2026.2.2
|
References
Frequently Asked Questions
What is CVE-2026-28471?
Which Openclaw versions are affected?
What version fixes CVE-2026-28471?
Is openclaw affected?
What is the CVSS score of CVE-2026-28471?
What CWE is associated with CVE-2026-28471?
How can I check npm dependencies for CVE-2026-28471?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-rmxw-jxxx-4cpc",
"modified" : "2026-03-06T01:01:45Z",
"published" : "2026-02-17T21:34:17Z",
"aliases" : [ "CVE-2026-28471" ],
"summary" : "OpenClaw has a Matrix allowlist bypass via displayName and cross-homeserver localpart matching",
"details" : "### Summary\n\nOpenClaw Matrix DM allowlist matching could be bypassed in certain configurations.\n\nMatrix support ships as an optional plugin (not bundled with the core install), so this only affects deployments that have installed and enabled the Matrix plugin.\n\n### Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected: `>= 2026.1.14-1, < 2026.2.2`\n- Patched: `>= 2026.2.2`\n\n### Details\n\nIn affected versions, DM allowlist decisions could be made by exact-matching `channels.matrix.dm.allowFrom` entries against multiple sender-derived candidates, including:\n\n- The sender display name (attacker-controlled and non-unique)\n- The sender MXID localpart with the homeserver discarded, so `@alice:evil.example` and `@alice:trusted.example` both match `alice`\n\nIf an operator configured `channels.matrix.dm.allowFrom` with display names or bare localparts (for example, `\"Alice\"` or `\"alice\"`), a remote Matrix user may be able to impersonate an allowed identity for allowlist purposes and reach the routing/agent pipeline.\n\n### Impact\n\nMatrix DM allowlist identity confusion. The practical impact depends on your Matrix channel policies and what capabilities are enabled downstream.\n\n### Mitigation\n\n- Upgrade to `openclaw >= 2026.2.2`.\n- Ensure Matrix allowlists contain only full Matrix user IDs (MXIDs) like `@user:server` (or `*`). Do not use display names or bare localparts.\n\n### Fix Commit(s)\n\n- `8f3bfbd1c4fb967a2ddb5b4b9a05784920814bcf`\n\n### Release Process Note\n\nThe patched version is already published to npm; the advisory can be published once you're ready.\n\nThanks @MegaManSec (https://joshua.hu) of [AISLE Research Team](https://aisle.com/) for reporting.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "openclaw"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2026.1.14-1"
}, {
"fixed" : "2026.2.2"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/openclaw/openclaw/security/advisories/GHSA-rmxw-jxxx-4cpc"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-28471"
}, {
"type" : "WEB",
"url" : "https://github.com/openclaw/openclaw/commit/8f3bfbd1c4fb967a2ddb5b4b9a05784920814bcf"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/openclaw/openclaw"
}, {
"type" : "WEB",
"url" : "https://github.com/openclaw/openclaw/releases/tag/v2026.2.2"
}, {
"type" : "WEB",
"url" : "https://www.vulncheck.com/advisories/openclaw-allowlist-bypass-via-displayname-and-cross-homeserver-localpart-matching-in-matrix"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-287", "CWE-290" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-02-17T21:34:17Z",
"nvd_published_at" : "2026-03-05T22:16:20Z"
}
}