Openclaw cli: OpenClaw: Matrix profile config persistence was reachable from operator.write message tools (CVE-2026-42433)

The openclaw-cli package had a security flaw (CVE-2026-42433) where the Matrix profile configuration persistence could be accessed and modified via operator.write message-tool paths. These paths should have required admin-level permissions but did not, allowing unauthorized mutation of persistent profile configurations. The vulnerability affects versions from 2026.1.29 up to but not including 2026.4.10. The fix, implemented in pull request #62662 and commit fe0f686c9228fffcec6de4011da45e69a6e23e54, gates Matrix profile updates for non-owner message-tool runs and prevents write-scoped callers from modifying persistent profile config. The issue is resolved in openclaw-cli versions 2026.4.10 and later.

Unauthorized users with write-scoped access to operator.write message tools could modify persistent Matrix profile configurations that should have been restricted to admin-level authority. This could lead to unauthorized configuration changes impacting system integrity. There is no indication of confidentiality or availability impact. The CVSS 3.1 score is 6.5 (medium severity) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Users should upgrade openclaw-cli to version 2026.4.10 or later. The fix is included starting from 2026.4.10, with the latest release 2026.4.14 containing the patch. No additional mitigation is required once upgraded.