Threats tagged 'ghsa-7hxm-f538-3xp6'

OpenClaw CLI's Matrix allowFrom feature could bind to mutable display names, allowing a Matrix account that can change display name metadata to match a policy entry through mutable display metadata. This vulnerability affects versions prior to 2026.5.7 and could lead to unauthorized agent access intended for another Matrix identity. The issue does not alter OpenClaw's trusted-operator model but depends on operator configuration and input trust levels. A patch is available in version 2026.5.7.