PT-2026-38243

CVE-2026-44110

Published

2026-05-06

Updated

2026-05-07

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.15

Description An authorization bypass exists in Matrix room control-command authorization due to improper trust in DM pairing-store entries. Attackers possessing DM-paired sender IDs can execute room control commands by posting in bot rooms, bypassing configured allowlists and potentially triggering privileged behavior.

Recommendations Update to version 2026.4.15.

Exploitability

Exploit

Fix

Impacts

Researchers

Keensecuritylab

Nathan

Qclawer

Vendors

Affected products

Weakness enumeration