OpenClaw Matrix Room Control Command Authorization Bypass

OpenClaw versions prior to 2026.4.15 contained a flaw in Matrix room control-command authorization. The system incorrectly included sender IDs learned from the Matrix DM pairing store in the effective allowlist for room traffic. This meant that a sender who was authorized only for a Matrix DM could potentially authorize room control commands when they also posted in a bot-controlled room. This vulnerability allows a DM-paired Matrix sender to cross the authorization boundary and run Matrix room control commands without being present in the configured room allowlist, room membership list, or group allowlist. The vulnerability affects OpenClaw versions > 2026.3.28 and < 2026.4.15. The issue was reported by @nexrin and Keen Security Lab and patched in version 2026.4.15.

Attack Chain

1. An attacker establishes a direct message (DM) pairing with the OpenClaw bot.
2. The attacker gains authorization to send messages within the DM channel.
3. The attacker identifies a Matrix room controlled by the OpenClaw bot.
4. The attacker sends a message to the bot-controlled room.
5. Due to the flawed authorization logic, the attacker's sender ID is incorrectly included in the effective allowlist for the room based on the DM pairing.
6. The attacker sends a specially crafted message to the bot-controlled room, containing a control command.
7. The OpenClaw bot, due to the bypassed authorization check, executes the control command.
8. The attacker achieves unauthorized control over the Matrix room, potentially driving privileged OpenClaw behavior.

Impact

This vulnerability allowed unauthorized users to execute Matrix room control commands within OpenClaw deployments. The impact severity is high because room control commands can drive privileged OpenClaw behavior depending on the deployment's command and tool policy. Successful exploitation could lead to unauthorized modification of room settings, access to sensitive information, or disruption of services managed by the OpenClaw bot. The number of potentially affected deployments is unknown, but all instances running vulnerable versions are at risk.

Recommendation

• Upgrade OpenClaw to version 2026.4.15 or later to patch the authorization bypass vulnerability.
• Review OpenClaw's command and tool policy to understand the scope of potential privileged behavior that could be triggered by room control commands.
• Deploy the Sigma rule Detect OpenClaw Room Control Command Execution from Unauthorized DM User to identify potential exploitation attempts.
• Monitor OpenClaw logs for unexpected room control command executions, particularly those originating from users with only DM pairing-store entries.