CVE-2026-53811: OpenClaw: Matrix allowFrom could bind to mutable display names

The Matrix channel decides who may talk to the agent with an allowFrom list. In affected versions, an entry could bind to mutable display metadata instead of a stable Matrix user ID. Any Matrix account can edit its own display name. An attacker who sets theirs to match a policy entry passes the check and is treated as the allowed person.

The attacker needs a Matrix account that can reach the bot, in a room or direct message, and does not need to touch the Gateway. What they get is the agent access of the identity they imitate. The sources say the practical effect depends on operator configuration. If the agent can run commands, read files or call tools, the attacker can ask it to do so. That explains the high confidentiality, integrity and availability scores.

This is a spoofing flaw (CWE-290). It applies only to deployments that list display names in allowFrom. Lists made of full Matrix user IDs are the safe form.

Affected: npm package openclaw 2026.5.6 and earlier, where the Matrix channel is enabled and allowFrom contains entries that can match a display name.

npm ls openclaw

Open your Gateway configuration and read the Matrix allowFrom entries. Entries that are plain names rather than IDs like @user:server are the ones at risk.

Upgrade to openclaw 2026.5.7 or later, the first stable patched version.

npm install -g [email protected]

Until you upgrade, use stable Matrix user IDs in allowlists. The advisory also advises narrow channel and tool allowlists and turning off Matrix if you do not need it. It does not describe the code change.

Check Matrix room membership and message history for accounts whose display name equals an allowFrom entry but whose user ID differs from the real person's. Look in Gateway logs for agent actions triggered by Matrix senders you do not recognize. The advisory lists no log strings.

Summary

Matrix allowFrom could bind to mutable display names. In affected versions, a Matrix account able to change display name metadata could match a policy entry through mutable display metadata.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

Impact

When the affected feature is enabled and reachable, this could receive agent access intended for another Matrix identity. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Patched Versions

The first stable patched version is 2026.5.7.

Mitigations

use stable Matrix user IDs in allowlists until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.