CVE-2026-100541

Name of the Vulnerable Software and Affected Versions @openclaw/matrix versions 2026.2.2 through 2026.8.0

Description The Matrix integration lowercases complete Matrix user IDs, including historical localparts and the case-sensitive server-name portion, when deriving the authorization identity. This causes distinct authenticated Matrix accounts to normalize to the same identity. A participant with a colliding account identifier—one that differs from a configured identifier only by characters that undergo case or Unicode folding—can inherit privileges such as allowlist, owner-command, exec-approval, or plugin-approval authority assigned to another account.

Recommendations Update @openclaw/matrix to version 2026.8.1.