OpenClaw channel plugins before version 2026.8.1 allow callers to request explicit read targets for messages, reactions, pins, members, and related metadata without honoring the channel read allowlist configured by operators. This flaw enables an attacker leveraging a lower‑trust sender or a steered agent that possesses channel read permissions to retrieve content or metadata from channels or rooms that have been explicitly excluded by the operator’s read policy. The practical impact depends on the permissions granted to the connected bot account, but it can result in unauthorized disclosure of potentially sensitive information.

Affected vendors include OpenClaw, with plugins for Feishu, Google Chat, Matrix, and Microsoft Teams. All releases prior to 2026.8.1 are vulnerable. Operators must verify that their environment is using a version later than 2026.8.1 to eliminate this vulnerability.

The CVSS score of 7.1 indicates a high severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. A likely attack vector is through a bot configuration or a compromised bot account that obtains channel read permissions; the attacker can then bypass the allowlist by specifying arbitrary read targets in API calls. The conditions required are possession of channel read permissions and a bot’s ability to construct read target payloads. Because the flaw does not require elevated privileges or exploitation of unrelated components, the exploitation probability is considered moderate based on the disclosed score and lack of active exploitation data.