CVE-2026-41376: 
OpenClaw (formerly Moltbot or Clawdbot) vulnerability analysis and mitigation

CVE-2026-41376 is an allowlist bypass vulnerability in OpenClaw, a Node.js-based Matrix messaging integration package, affecting all versions prior to 2026.3.31. The flaw exists in Matrix thread root and reply context handling, where the application fails to properly validate message senders against configured sender allowlists. This allows network-accessible attackers to retrieve thread-root and reply context messages that should have been filtered. The vulnerability was published on April 28, 2026, with a fix committed on March 31, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 2.3 (Low) (GitHub Advisory, Feedly).

The root cause is classified as CWE-346 (Origin Validation Error): when OpenClaw fetches thread-root or reply context messages from a Matrix room, it did not apply the configured sender allowlist to the fetched context events — only to the triggering message. Specifically, the resolveThreadContext and resolveReplyContext functions returned message content and sender information without checking whether the context message's sender (senderId) was permitted by the room's effectiveGroupAllowFrom or effectiveRoomUsers allowlist. The fix, introduced in commit 8a563d603b70ef6338915f0527bee87282c3bad5, adds a shouldIncludeRoomContextSender() guard that evaluates the context sender against the allowlist before including thread or reply context in the inbound message body (GitHub Commit, GitHub Advisory). No authentication is required to trigger the bypass, but the attacker must be able to send a message in a Matrix room where the target OpenClaw instance is active.

Successful exploitation allows an attacker to expose the content and sender identity of thread-root or reply context messages that were intended to be restricted by sender allowlists, resulting in unauthorized disclosure of potentially sensitive conversation content. The integrity impact is low, as the attacker can influence what context is surfaced to the agent processing the message. Availability is not affected. The scope is limited to the OpenClaw deployment's configured Matrix rooms, but sensitive business or operational data shared in restricted threads could be exposed (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability requires no privileges and no user interaction on the attacker's part, but does require the attacker to be present in a Matrix room monitored by a vulnerable OpenClaw instance (GitHub Advisory).

1. Reconnaissance: Identify a Matrix room monitored by a vulnerable OpenClaw instance (version ≤ 2026.3.28) where a sender allowlist is configured.
2. Join the room: Obtain access to the Matrix room as a non-allowlisted user (e.g., @mallory:example.org) or control a Matrix account not on the allowlist.
3. Create a thread root: Send a message to the room to establish a thread root event (e.g., $thread-root) from the non-allowlisted account.
4. Trigger context fetch: Have an allowlisted user (or simulate one) send a reply or thread follow-up that references the non-allowlisted thread root event via m.thread or m.in_reply_to relation.
5. Bypass allowlist: The vulnerable OpenClaw instance fetches the thread-root or reply context without validating the sender, causing the restricted message content and sender identity to be included in the processed inbound context — effectively bypassing the allowlist filter.
6. Observe exposed data: The attacker's message content (body, sender) is surfaced to the OpenClaw agent or downstream system, exposing information that should have been filtered (GitHub Commit, GitHub Advisory).

• Logs: OpenClaw verbose logs missing entries such as matrix: drop thread root context (sender allowlist) or matrix: drop reply context (sender allowlist) when messages from non-allowlisted senders are present in thread or reply context — these log lines were added in the fix and their absence on older versions may indicate exposure.
• Application Behavior: Thread-root or reply context bodies from non-allowlisted Matrix senders appearing in OpenClaw-processed inbound messages or downstream agent outputs.
• Matrix Room Events: Presence of thread-root or reply events (m.thread, m.in_reply_to) from non-allowlisted sender IDs (e.g., users not in groupAllowFrom) in rooms monitored by OpenClaw.

Upgrade OpenClaw (npm package) to version 2026.3.31 or later, which contains the fix introduced in commit 8a563d603b70ef6338915f0527bee87282c3bad5. No configuration-based workaround is available for versions prior to 2026.3.31, as the bypass occurs at the code level regardless of allowlist configuration. After upgrading, review any thread or reply context data that may have been processed during the exposure window for potential information disclosure (GitHub Advisory, GitHub Commit).

The vulnerability was reported by security researcher AntAISecurityLab and acknowledged by the OpenClaw maintainers, with the fix authored by jacobtomlinson (GitHub Advisory). No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified.