Beveiligingsadvies

CVE-2026-28471

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-03-05 21:59:47

Laatst bijgewerkt 2026-03-09 18:03:59

Toegewezen door VulnCheck

CVSS-score 6.3

Status PUBLISHED

Beschrijving

OpenClaw version 2026.1.14-1 prior to 2026.2.2, with the Matrix plugin installed and enabled, contain a vulnerability in which DM allowlist matching could be bypassed by exact-matching against sender display names and localparts without homeserver validation. Remote Matrix users can impersonate allowed identities by using attacker-controlled display names or matching localparts from different homeservers to reach the routing and agent pipeline.

← Alle CVE's bekijken Bekijk op cve.org ↗