Versions affected: 2026.2.2 up to, not including, 2026.8.1 (Source: NIST NVD, CVE-2026-100541 (September 28, 2026))
Access controls often depend on one step: deciding who someone is. CVE-2026-100541 shows what happens when that step goes wrong. A tool tidies up names before it checks permissions. Two different accounts end up treated as one identity.
The record comes from the NIST National Vulnerability Database (NVD). It was published September 26, 2026 and last changed September 28. It covers OpenClaw's Matrix integration, which ships as the npm package @openclaw/matrix. Matrix is a chat protocol. Every account on it has a user ID.
What the flaw is
The NVD record says the package lowercases the whole Matrix user ID. It does this when it builds the identity used to decide what an account may do. That covers the account name and the server name. The server-name part is case-sensitive.
So two separate, logged-in accounts can end up with the same identity inside OpenClaw. The record says the clash also covers other characters that OpenClaw folds together under its case and Unicode handling. An attacker does not need a matching display name.
Picture a bank clerk who treats "J. Smith" and "j smith" as the same signature. The clerk means well. But now two signers share one set of rights.
What an attacker could inherit
Suppose someone controls an account ID that clashes with another user's ID. That person can inherit the other user's authority. The NVD record names four kinds: allowlist entries, owner commands, exec approvals and plugin approvals.
The record does not explain what OpenClaw does or what those approvals unlock. Still, they are the kind of permission a company wants tied to one named person. An approval answers the question "who said yes?" Here, the answer could be wrong.
How serious it is, and its limits
VulnCheck scored the flaw as high severity under two scoring systems. Both vectors rate attack complexity as high. Both rate the privileges needed as low. In plain terms, the attacker needs a working, logged-in account. The setup also has to line up.
The record leaves some questions open. It does not report attacks in the wild. It does not say how easily someone could register a colliding ID on a given Matrix server. Those answers depend on each deployment.
The lesson: a tidy name is not a verified identity
This points to a design habit, not just one bug. Cleaning up input is fine for search and display. Lowercasing, folding characters and trimming all help there. It becomes risky when the cleaned-up copy is used as the key for a permission. A permission check should use the exact identity the system verified.
The record says version 2026.8.1 fixes the issue. Teams on an affected version have a clear update to apply. The bigger question is where else in your stack a name quietly becomes a permission.
What to ask your team
First, ask whether @openclaw/matrix is installed anywhere, and which version. Anything from 2026.2.2 up to, but not including, 2026.8.1 is affected.
Second, ask for a list of every account with special powers in OpenClaw. Check that each one is tied to a full, exact account ID.
Third, ask whether your logs can show near-duplicate IDs. These would differ only by letter case or characters that Unicode folding treats as equal. If your logs cannot show that, closing the gap is worth the effort.
Fourth, ask the same questions about any other tool that lets chat identities approve actions. An approval is only as trustworthy as the identity check behind it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: NIST NVD.
