OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass
OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-trust sender or a steered agent with access to a channel read action can therefore retrieve content or metadata from channels or rooms excluded by the operator's read policy; the practical impact depends on the permissions held by the connected bot account. The issue is fixed in 2026.8.1.
CVE-2026-100582
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-100582
msteams
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
feishu
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
matrix
Source reference: /containers/cna/affected/2/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
googlechat
Source reference: /containers/cna/affected/3/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "openclaw",
"product": "msteams",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2026.8.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2026.8.1",
"versionType": "semver"
}
],
"packageURL": "pkg:npm/%40openclaw/msteams",
"defaultStatus": "unaffected"
},
{
"vendor": "openclaw",
"product": "feishu",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2026.8.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2026.8.1",
"versionType": "semver"
}
],
"packageURL": "pkg:npm/%40openclaw/feishu",
"defaultStatus": "unaffected"
},
{
"vendor": "openclaw",
"product": "matrix",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2026.8.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2026.8.1",
"versionType": "semver"
}
],
"packageURL": "pkg:npm/%40openclaw/matrix",
"defaultStatus": "unaffected"
},
{
"vendor": "openclaw",
"product": "googlechat",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2026.8.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2026.8.1",
"versionType": "semver"
}
],
"packageURL": "pkg:npm/%40openclaw/googlechat",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-100582
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #12665 · Revision 1
- Added to Heist Feed
- Publisher date