All vulnerabilities
CVE-2026-100582GHSA-g7fw-3gjp-g5hf

msteams: OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass

openclaw msteamsnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2026.8.1Fixed versionCVE List
Published26 Sep 2026Updated 8 Oct 2026CVE List

What fixes it

  • 2026.8.1msteamsCVE List
  • 2026.8.1feishuCVE List
  • 2026.8.1matrixCVE List
  • 2026.8.1googlechatCVE List
  • 2026.8.1@openclaw/msteams, npmOSVnpm install @openclaw/msteams@2026.8.1
  • 2026.8.1@openclaw/feishu, npmOSVnpm install @openclaw/feishu@2026.8.1
Show all 8 fixed versions
  • 2026.8.1@openclaw/matrix, npmOSVnpm install @openclaw/matrix@2026.8.1
  • 2026.8.1@openclaw/googlechat, npmOSVnpm install @openclaw/googlechat@2026.8.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-trust sender or a steered agent with access to a channel read action can therefore retrieve content or metadata from channels or rooms excluded by the operator's read policy; the practical impact depends on the permissions held by the connected bot account. The issue is fixed in 2026.8.1.

Text from CVE List

Affected versions 12

  • msteamsaffected: all versions before 2026.8.1CVE List
  • msteamsunaffected: 2026.8.1CVE List
  • feishuaffected: all versions before 2026.8.1CVE List
  • feishuunaffected: 2026.8.1CVE List
  • matrixaffected: all versions before 2026.8.1CVE List
  • matrixunaffected: 2026.8.1CVE List
  • googlechataffected: all versions before 2026.8.1CVE List
  • googlechatunaffected: 2026.8.1CVE List
  • @openclaw/msteams, npmfrom first release, fixed in 2026.8.1OSV
  • @openclaw/feishu, npmfrom first release, fixed in 2026.8.1OSV
  • @openclaw/matrix, npmfrom first release, fixed in 2026.8.1OSV
  • @openclaw/googlechat, npmfrom first release, fixed in 2026.8.1OSV

References 2