CVE-2026-100582 in feishu
Summary
by MITRE • 09/26/2026
OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-trust sender or a steered agent with access to a channel read action can therefore retrieve content or metadata from channels or rooms excluded by the operator's read policy; the practical impact depends on the permissions held by the connected bot account. The issue is fixed in 2026.8.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The identified vulnerability resides within several OpenClaw channel plugins, specifically those designed for integration with Microsoft Teams, Feishu, Matrix, and Google Chat. These components are responsible for mediating interactions between the core application logic and external communication platforms. The critical flaw is a failure in access control enforcement regarding configured read allowlists when handling explicit read targets supplied by callers. In secure system design, an operator-defined policy should restrict which channels or rooms a bot account can access based on predefined permissions. However, in versions prior to 2026.8.1, the plugins do not validate these caller-supplied parameters against the established allowlist before executing metadata read actions. This oversight affects various operations including message retrieval, reaction data fetching, pin management, and member list queries.
From a technical perspective, this represents a classic Broken Access Control vulnerability where input validation is insufficient to enforce security policies. When an application accepts explicit identifiers for resources such as channel IDs or room names from external callers without verifying them against the system's access control matrix, it allows unauthorized traversal of protected areas. An attacker who can influence these parameters, either through direct interaction with a lower-trust sender account or by steering an agent that possesses read permissions, can bypass the intended restrictions. The vulnerability effectively neutralizes the operator's attempt to limit data exposure by ignoring the configured boundaries during explicit read operations.
The operational impact of this flaw is directly tied to the privileges held by the connected bot account within the respective communication platform. If the bot has broad administrative or member-level permissions, an attacker could potentially exfiltrate sensitive messages, view private group discussions, retrieve pinned confidential information, or enumerate members in restricted channels that were explicitly excluded from the read policy. This leads to a significant confidentiality breach, as data intended for specific audiences becomes accessible to unauthorized entities. The severity scales with the sensitivity of the content stored within these excluded channels and the level of access granted to the compromised bot identity.
This vulnerability aligns closely with CWE-284 Improper Access Control, specifically reflecting failures in enforcing user authorization restrictions on critical functions. In terms of offensive security frameworks, it maps to MITRE ATT&CK technique T1530 Data from Cloud Storage Object or T1567 Exfiltration Over Web Service, depending on how the retrieved data is subsequently transmitted out of the environment. The lack of validation for explicit targets allows an attacker to pivot through trusted bot accounts to access otherwise isolated information silos.
To mitigate this risk, organizations must upgrade all affected OpenClaw channel plugins to version 2026.8.1 or later immediately upon availability. This update implements proper validation logic that ensures caller-supplied read targets are checked against the configured allowlist before any data retrieval occurs. Until the patch is applied, administrators should review bot permissions and minimize them to the principle of least privilege, ensuring that even if this vulnerability is exploited, the scope of accessible data remains limited. Additionally, monitoring logs for unusual patterns in channel access requests can help detect potential exploitation attempts while mitigation measures are being deployed.