Duplicate Advisory: OpenClaw: Mattermost handlers could fall open when channel type was missing

OpenClaw prior to version 2026.5.6 has an access control vulnerability (CWE-636) in its Mattermost event handlers. The vulnerability occurs because the handlers do not properly validate the channel type metadata in incoming events. Attackers can exploit this by sending specially crafted Mattermost events that omit channel type information, thereby bypassing intended DM policy enforcement and processing restricted content improperly. This issue has been assigned a CVSS 3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N), indicating a network attack vector with high attack complexity but no privileges or user interaction required, resulting in limited integrity impact without confidentiality or availability loss. The vulnerability is classified as moderate severity and is tracked under GHSA-chqm-wxm2-w73w.

The vulnerability allows attackers to bypass direct message policy restrictions by exploiting improper validation of channel type metadata in Mattermost event handlers. This can lead to unauthorized processing of restricted content, impacting data integrity. There is no impact on confidentiality or availability. No known exploits in the wild have been reported.

A patch is available for OpenClaw to fix this vulnerability in version 2026.5.6. Users should upgrade to version 2026.5.6 or later to remediate this issue. Since this is not a cloud service, remediation depends on applying the patch. No vendor advisory indicating 'no action required' or 'already mitigated' was provided.