Authorization Bypass in OpenClaw Matrix Room Control Commands

CVE-2026-44110

What is CVE-2026-44110?

OpenClaw prior to version 2026.4.15 is susceptible to an authorization bypass vulnerability that arises from relying on DM pairing-store entries for Matrix room control-command authorization. This vulnerability allows attackers with DM-paired sender IDs to issue room control commands, circumventing configured allowlists. As a result, malicious actors can potentially exploit this weakness to gain unauthorized privileges and perform sensitive actions within OpenClaw bot rooms.

References