Improper Handling of Case Sensitivity in OpenClaw - CVE-2026-100541
Published: November 3, 2026
Vulnerability identifier: #VU158801
CSH Severity: Low
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-100541
CWE-ID: CWE-178
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges by inheriting authorization granted to another Matrix account.
The vulnerability exists due to improper handling of case sensitivity in OpenClaw's Matrix authorization component when normalizing complete user IDs. A remote user can use a protocol-valid account identifier that differs from another account's identifier only by characters OpenClaw folds to inherit that account's allowlist, owner-command, exec-approval, or plugin-approval authority.
Affected software
OpenClaw
How to mitigate CVE-2026-100541
Install security update from vendor's website.
OpenClaw - update to 2026.8.1