AI Threat AlertGHSA-g7fw-3gjp-g5hf: OpenClaw channels: allowlist bypass exposes chat reads
GHSA-g7fw-3gjp-g5hfMEDIUMSeveral OpenClaw channel plugins (Microsoft Teams, Feishu, Matrix and Google Chat) failed to enforce the operator's target allowlist on read actions. A low-privileged sender, or an agent that has been steered by prompt injection, could therefore pull messages, reactions, pins, member lists and metadata from channels or rooms the operator had explicitly excluded. The advisory is rated medium (CVSS 6.5, high confidentiality impact, no integrity or availability impact), and there is no KEV listing, no public exploit, no Nuclei template and no EPSS data, so there is no evidence of active exploitation. Exposure is limited to what the bot account can see on the platform, but for enterprise Teams or Matrix tenants that can include sensitive internal discussions, and the package has 549 other tracked CVEs, which signals a heavy patching burden. Upgrade all four affected plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, @openclaw/googlechat) to 2026.8.1 or later. Until you can patch, disable explicit-target read actions or restrict the bot account to approved channels at the platform level.
What is the risk?
Medium. The attack is network-reachable, low complexity, needs low privileges and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and the impact is confidentiality only. Likelihood is moderated by the need for some access to the agent or channel (a lower-trust sender or a steered agent), the lack of any known public exploit or KEV listing, and the fact that practical impact is capped by the bot account's platform permissions. The risk rises in deployments where the bot has broad workspace-wide read scopes, or where the agent processes untrusted content that could steer it toward off-allowlist targets.
How does the attack unfold?
What systems are affected?
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade each affected plugin (@openclaw/googlechat, @openclaw/matrix, @openclaw/feishu, @openclaw/msteams) to 2026.8.1 or later, and update the openclaw core package to the matching release. 2) Before patching, disable explicit-target read actions in the agent configuration. 3) Enforce least privilege at the platform level by limiting the bot account or app registration to the channels it needs (Teams RSC and app permissions, Google Chat space membership, Matrix room membership, Feishu app scopes). 4) Review agent and gateway logs for read calls to channels or rooms not on the allowlist, especially since the plugin versions went into use. 5) Treat any content retrieved from excluded channels as potentially exposed and assess whether a notification or data-handling review is needed. 6) Add the plugins to dependency monitoring so future advisories in this package family are caught quickly.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is GHSA-g7fw-3gjp-g5hf?
Several OpenClaw channel plugins (Microsoft Teams, Feishu, Matrix and Google Chat) failed to enforce the operator's target allowlist on read actions. A low-privileged sender, or an agent that has been steered by prompt injection, could therefore pull messages, reactions, pins, member lists and metadata from channels or rooms the operator had explicitly excluded. The advisory is rated medium (CVSS 6.5, high confidentiality impact, no integrity or availability impact), and there is no KEV listing, no public exploit, no Nuclei template and no EPSS data, so there is no evidence of active exploitation. Exposure is limited to what the bot account can see on the platform, but for enterprise Teams or Matrix tenants that can include sensitive internal discussions, and the package has 549 other tracked CVEs, which signals a heavy patching burden. Upgrade all four affected plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, @openclaw/googlechat) to 2026.8.1 or later. Until you can patch, disable explicit-target read actions or restrict the bot account to approved channels at the platform level.
Is GHSA-g7fw-3gjp-g5hf actively exploited?
No confirmed active exploitation of GHSA-g7fw-3gjp-g5hf has been reported, but organizations should still patch proactively.
How to fix GHSA-g7fw-3gjp-g5hf?
1) Upgrade each affected plugin (@openclaw/googlechat, @openclaw/matrix, @openclaw/feishu, @openclaw/msteams) to 2026.8.1 or later, and update the openclaw core package to the matching release. 2) Before patching, disable explicit-target read actions in the agent configuration. 3) Enforce least privilege at the platform level by limiting the bot account or app registration to the channels it needs (Teams RSC and app permissions, Google Chat space membership, Matrix room membership, Feishu app scopes). 4) Review agent and gateway logs for read calls to channels or rooms not on the allowlist, especially since the plugin versions went into use. 5) Treat any content retrieved from excluded channels as potentially exposed and assess whether a notification or data-handling review is needed. 6) Add the plugins to dependency monitoring so future advisories in this package family are caught quickly.
What systems are affected by GHSA-g7fw-3gjp-g5hf?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, chat-integrated AI assistants, multi-channel messaging gateways, tool-calling agents.
What is the CVSS score for GHSA-g7fw-3gjp-g5hf?
GHSA-g7fw-3gjp-g5hf has a CVSS v3.1 base score of 6.5 (MEDIUM).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0036Data from Information RepositoriesAML.T0053AI Agent Tool InvocationAML.T0085.001AI Agent ToolsCompliance Controls Affected
What are the technical details?
Original Advisory
### Summary Channel read actions could skip target allowlists. In affected versions, explicit read targets in Microsoft Teams, Feishu, Matrix, and Google Chat could reach channels or rooms outside the configured read policy. This advisory is scoped to caller-supplied targets for message, reaction, pin, member, and related metadata reads in the named plugins. It does not change OpenClaw's trusted-operator model or create per-user isolation within one Gateway. ### Impact A lower-trust sender or steered agent with access to a channel read action could retrieve content or metadata from a target excluded by the operator's channel allowlist. Practical impact depends on the bot account's platform permissions. ### Patched Versions The first stable patched version is `2026.8.1`. ### Mitigations upgrade each affected channel plugin to `2026.8.1` or later. Before upgrading, disable explicit-target read actions or limit the connected bot account to allowed channels at the platform level.
Exploitation Scenario
An attacker with low-trust access to a channel where the OpenClaw agent is active, or one who plants instructions in content the agent processes, asks the agent to read recent messages, pins or the member list of a private executive or incident-response channel that the operator allowlist excludes. Because the plugin skips allowlist validation for explicit targets, the read succeeds using the bot's platform permissions. The agent returns or summarizes the content, and the attacker gains confidential discussions, internal links or staff directory information that can be used for follow-on social engineering or further access.
Weaknesses (CWE)
CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
- [Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- [Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-221729.9OpenClaw: WebSocket scope self-elevation grants admin
Same package: openclawCVE-2026-335799.9OpenClaw: scope bypass escalates low-priv to admin
Same package: openclawCVE-2026-329229.9OpenClaw: privilege escalation to RCE via token scope bypass
Same package: openclawCVE-2026-307419.8OpenClaw: RCE via request-side prompt injection
Same package: openclawCVE-2026-320389.8OpenClaw: sandbox bypass enables container lateral movement
Same package: openclaw