OpenClaw versions before 2026.2.2 with the Matrix plugin enabled contain a flaw that allows the DM allowlist to be bypassed. An attacker can produce a sender display name or localpart that matches an entry on the allowance list without the homeserver being validated. This bypass enables remote Matrix users to impersonate identities that should be trusted, potentially allowing the delivery of messages through the routing and agent pipeline under false credentials.

The vulnerability affects installations of OpenClaw OpenClaw version 2026.1.14-1 up to, but not including, 2026.2.2 when the Matrix plugin is installed and enabled. Users of later versions are not affected.

The CVSS score of 6.3 indicates a moderate severity, while the EPSS score of less than 1% reflects a low likelihood of exploitation observed so far. The vulnerability is not listed in the CISA KEV catalog. The main attack vector is remote, as any Matrix user can craft the necessary display name or localpart to trigger the bypass. This allows an adversary to bring malicious or unauthorized content through the system without proper homeserver validation, potentially leading to unauthorized message delivery or identity spoofing.