Nixpkgs security tracker
7.7 HIGH
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Attack Requirement (AT): Present (P)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): High (H)
- Vulnerable System Impact Integrity (VI): High (H)
- Vulnerable System Impact Availability (VA): High (H)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Attack Requirement (MAT): Present (P)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): High (H)
- Modified Vulnerable System Impact Integrity (MVI): High (H)
- Modified Vulnerable System Impact Availability (MVA): High (H)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
by @symphorien Activity log
- Created suggestion
-
@symphorien
ignored
13 packages
- matrix-brandy
- matrix-conduit
- matrix-synapse
- matrix-tuwunel
- matrix-corporal
- matrix-hookshot
- weechat-matrix-rs
- matrix-synapse-plugins.matrix-synapse-s3-storage-provider
- matrix-synapse-plugins.matrix-synapse-shared-secret-auth
- matrix-synapse-plugins.matrix-synapse-mjolnir-antispam
- matrix-synapse-plugins.matrix-http-rendezvous-synapse
- matrix-synapse-plugins.matrix-synapse-ldap3
- matrix-synapse-plugins.matrix-synapse-pam
OpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Folding
OpenClaw's Matrix integration (npm package @openclaw/matrix) versions >= 2026.2.2 and < 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and the case-sensitive server-name portion — when deriving the OpenClaw authorization identity. As a result, distinct authenticated Matrix accounts can normalize to the same authorization identity. A Matrix participant controlling a colliding account identifier (a protocol-valid identifier that differs from the configured one only by characters OpenClaw case/Unicode folds; display-name matching is not required) can inherit allowlist, owner-command, exec-approval, or plugin-approval authority configured for another account. The issue is fixed in 2026.8.1.
References
-
GitHub Security Advisory (GHSA-hgv5-f2r3-6v9r) vendor-advisory
Affected products
- <2026.8.1
- ==2026.8.1
Matching in nixpkgs
pkgs.cmatrix
Simulates the falling characters theme from The Matrix movie
pkgs.tmatrix
Terminal based replica of the digital rain from The Matrix
pkgs.dendrite
Second-generation Matrix homeserver written in Go
pkgs.gomatrix
Displays "The Matrix" in a terminal
pkgs.matrix-dl
Download backlogs from Matrix as raw text
-
nixos-unstable -
- nixos-unstable-small 0-unstable-2020-07-14
-
nixos-26.05 -
- nixos-26.05-small 0-unstable-2020-07-14
pkgs.unimatrix
Python script to simulate the display from "The Matrix" in terminal
-
nixos-unstable -
- nixos-unstable-small 0-unstable-2026-05-20
-
nixos-26.05 -
- nixos-26.05-small 0-unstable-2023-04-25
pkgs.libcmatrix
Matrix protocol library written in C using GObject
pkgs.matrix-hook
Simple webhook for matrix
pkgs.kodiPackages.six
Python 2 and 3 compatibility utilities
-
nixos-unstable -
- nixos-unstable-small 1.16.0+matrix.1
-
nixos-26.05 -
- nixos-26.05-small 1.16.0+matrix.1
pkgs.matrix-commander
Simple but convenient CLI-based Matrix client app for sending and receiving
pkgs.matrix-gtk-theme
None
-
nixos-26.05 -
- nixos-26.05-small 0-unstable-2025-10-15
pkgs.matrix-media-repo
Highly configurable multi-domain media repository for Matrix
pkgs.kodiPackages.future
Missing compatibility layer between Python 2 and Python 3
-
nixos-unstable -
- nixos-unstable-small 1.0.0+matrix.1
-
nixos-26.05 -
- nixos-26.05-small 1.0.0+matrix.1
pkgs.kodiPackages.upnext
Up Next - Proposes to play the next episode automatically
-
nixos-unstable -
- nixos-unstable-small 1.1.9+matrix.1
-
nixos-26.05 -
- nixos-26.05-small 1.1.9+matrix.1
pkgs.matrix-alertmanager
Bot to receive Alertmanager webhook events and forward them to chosen rooms
pkgs.matrix-commander-rs
CLI-based Matrix client app for sending and receiving
pkgs.matrix-continuwuity
Matrix homeserver written in Rust, forked from conduwuit
pkgs.matrix-zulip-bridge
Matrix puppeting appservice bridge for Zulip
pkgs.rubyPackages.matrix
None
pkgs.kodiPackages.routing
Routing module for kodi plugins
-
nixos-unstable -
- nixos-unstable-small 0.2.3+matrix.1
-
nixos-26.05 -
- nixos-26.05-small 0.2.3+matrix.1
pkgs.kodiPackages.signals
Provides signal/slot mechanism for inter-addon communication
-
nixos-unstable -
- nixos-unstable-small 0.0.6+matrix.1
-
nixos-26.05 -
- nixos-26.05-small 0.0.6+matrix.1
pkgs.matrix-appservice-irc
Node.js IRC bridge for Matrix
pkgs.plymouth-matrix-theme
Plymouth boot theme inspired by Matrix
-
nixos-unstable -
- nixos-unstable-small 0.1.0-unstable-2017-02-19
-
nixos-26.05 -
- nixos-26.05-small 0.1.0-unstable-2017-02-19
pkgs.haskellPackages.matrix
A native implementation of matrix operations
pkgs.kodiPackages.orftvthek
Addon for accessing the Austrian ORF ON streaming service
-
nixos-unstable -
- nixos-unstable-small 1.0.3+matrix.1
-
nixos-26.05 -
- nixos-26.05-small 1.0.3+matrix.1
pkgs.haskellPackages.hmatrix
Numeric Linear Algebra
pkgs.kodiPackages.defusedxml
Defusing XML bombs and other exploits
-
nixos-unstable -
- nixos-unstable-small 0.6.0+matrix.1
-
nixos-26.05 -
- nixos-26.05-small 0.6.0+matrix.1
pkgs.kodiPackages.mediacccde
media.ccc.de for Kodi
-
nixos-unstable -
- nixos-unstable-small 0.3.0+matrix.1
-
nixos-26.05 -
- nixos-26.05-small 0.3.0+matrix.1
pkgs.kodiPackages.simplejson
Simple, fast, extensible JSON encoder/decoder for Python
-
nixos-unstable -
- nixos-unstable-small 3.19.1+matrix.1
-
nixos-26.05 -
- nixos-26.05-small 3.19.1+matrix.1
pkgs.rubyPackages_3_3.matrix
None
pkgs.rubyPackages_3_4.matrix
None
pkgs.rubyPackages_4_0.matrix
None
pkgs.matrix-sdk-crypto-nodejs
No-network-IO implementation of a state machine that handles E2EE for Matrix clients
-
nixos-unstable -
- nixos-unstable-small 0.4.0-beta.1
-
nixos-26.05 -
- nixos-26.05-small 0.4.0-beta.1
pkgs.matrix-synapse-unwrapped
Matrix reference homeserver
pkgs.kodiPackages.trakt-module
Python trakt.py library packed for Kodi
-
nixos-unstable -
- nixos-unstable-small 4.4.0+matrix.1
-
nixos-26.05 -
- nixos-26.05-small 4.4.0+matrix.1
pkgs.matrix-appservice-discord
None
-
nixos-26.05 -
- nixos-26.05-small 4.0.0
pkgs.haskellPackages.hmatrix-csv
CSV encoding and decoding for hmatrix
pkgs.haskellPackages.hmatrix-gsl
Numerical computation
pkgs.kodiPackages.requests-cache
Persistent cache for requests library
-
nixos-unstable -
- nixos-unstable-small 0.5.2+matrix.2
-
nixos-26.05 -
- nixos-26.05-small 0.5.2+matrix.2
pkgs.python313Packages.canmatrix
Support and convert several CAN (Controller Area Network) database formats
pkgs.python314Packages.canmatrix
Support and convert several CAN (Controller Area Network) database formats
pkgs.haskellPackages.hmatrix-glpk
Linear Programming based on GLPK
pkgs.haskellPackages.hmatrix-repa
Adaptors for interoperability between hmatrix and repa
pkgs.matrix-alertmanager-receiver
Alertmanager client that forwards alerts to a Matrix room
pkgs.python313Packages.matrix-nio
Python Matrix client library, designed according to sans I/O principles
pkgs.python314Packages.matrix-nio
Python Matrix client library, designed according to sans I/O principles
pkgs.haskellPackages.hmatrix-nlopt
Interface HMatrix with the NLOPT minimizer
pkgs.haskellPackages.matrix-client
A matrix client library
pkgs.haskellPackages.matrix-static
Type-safe matrix operations
pkgs.matrix-authentication-service
OAuth2.0 + OpenID Provider for Matrix Homeservers
pkgs.haskellPackages.lapack-hmatrix
Conversion of objects between 'lapack' and 'hmatrix'
pkgs.kodiPackages.inputstreamhelper
Simple Kodi module that makes life easier for add-on developers relying on InputStream based add-ons and DRM playback
-
nixos-unstable -
- nixos-unstable-small 0.6.1+matrix.1
-
nixos-26.05 -
- nixos-26.05-small 0.6.1+matrix.1
pkgs.python313Packages.osadl-matrix
OSADL license compatibility matrix as a CSV
-
nixos-unstable -
- nixos-unstable-small 2024.05.23.010555
pkgs.python314Packages.osadl-matrix
OSADL license compatibility matrix as a CSV
-
nixos-unstable -
- nixos-unstable-small 2024.05.23.010555
pkgs.haskellPackages.hmatrix-special
Interface to GSL special functions
pkgs.python313Packages.matrix-client
Python Matrix Client-Server SDK
pkgs.python313Packages.matrix-common
Common utilities for Synapse, Sydent and Sygnal
pkgs.python314Packages.matrix-client
Python Matrix Client-Server SDK
pkgs.python314Packages.matrix-common
Common utilities for Synapse, Sydent and Sygnal
pkgs.gnomeExtensions.matrix-code-rain
Matrix animated green code rain behind your windows on every workspace and monitor.
-
nixos-unstable -
- nixos-unstable-small 5
pkgs.gnomeExtensions.workspace-matrix
Arrange workspaces in a two dimensional grid with workspace thumbnails.
pkgs.haskellPackages.hmatrix-backprop
hmatrix operations lifted for backprop
pkgs.python313Packages.ppf-datamatrix
Pure-python package to generate data matrix codes
pkgs.python314Packages.ppf-datamatrix
Pure-python package to generate data matrix codes
pkgs.haskellPackages.hmatrix-gsl-stats
GSL Statistics interface
pkgs.kodiPackages.visualization-matrix
Matrix visualization for kodi
pkgs.haskellPackages.hmatrix-quadprogpp
Bindings to the QuadProg++ quadratic programming library
pkgs.haskellPackages.matrix-market-pure
Pure and composable reader and writer of the Matrix Market format
pkgs.open-music-kontrollers.midi_matrix
LV2 MIDI channel matrix patcher
pkgs.open-music-kontrollers.patchmatrix
JACK patchbay in flow matrix style
pkgs.haskellPackages.hmatrix-vector-sized
Conversions between hmatrix and vector-sized types
pkgs.weechatScripts.weechat-matrix-bridge
WeeChat script in Lua that implements the matrix.org chat protocol
-
nixos-unstable -
- nixos-unstable-small 2018-11-19
-
nixos-26.05 -
- nixos-26.05-small 2018-11-19
pkgs.gnomeExtensions.matrix-status-monitor
High-performance Matrix notification monitor for GNOME Shell.
pkgs.haskellPackages.matrix-market-attoparsec
Parsing and serialization functions for the NIST Matrix Market format
Ignored packages (13)
pkgs.matrix-brandy
Matrix Brandy BASIC VI for Linux, Windows, MacOSX
pkgs.matrix-conduit
Matrix homeserver written in Rust
pkgs.matrix-synapse
Matrix reference homeserver
pkgs.matrix-tuwunel
Matrix homeserver written in Rust, official successor to conduwuit
pkgs.matrix-corporal
Reconciliator and gateway for a managed Matrix server
pkgs.matrix-hookshot
Bridge between Matrix and multiple project management services, such as GitHub, GitLab and JIRA
pkgs.weechat-matrix-rs
Rust plugin for WeeChat to communicate over Matrix
-
nixos-unstable -
- nixos-unstable-small 0-unstable-2026-07-16
-
nixos-26.05 -
- nixos-26.05-small 0-unstable-2025-10-09
pkgs.matrix-synapse-plugins.matrix-synapse-pam
PAM auth provider for the Synapse Matrix server
pkgs.matrix-synapse-plugins.matrix-synapse-ldap3
LDAP3 auth provider for Synapse
pkgs.matrix-synapse-plugins.matrix-http-rendezvous-synapse
Implementation of MSC3886: Simple rendezvous capability
pkgs.matrix-synapse-plugins.matrix-synapse-mjolnir-antispam
AntiSpam / Banlist plugin to be used with mjolnir
pkgs.matrix-synapse-plugins.matrix-synapse-shared-secret-auth
Shared Secret Authenticator password provider module for Matrix Synapse
pkgs.matrix-synapse-plugins.matrix-synapse-s3-storage-provider
Synapse storage provider to fetch and store media in Amazon S3
Package maintainers
-
@Tert0 Tert0 <tert0byte@gmail.com>
-
@yaaaarn yarncat <nix@yarncat.moe>
-
@skykanin skykanin
-
@herrwiese Andreas Wiese <aw-nixos@meterriblecrew.net>
-
@Anomalocaridid Duncan Russell <duncan@anomalocaris.xyz>
-
@dotlambda ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 <nix@dotlambda.de>
-
@pinpox Pablo Ovelleiro Corral <mail@pablo.tools>
-
@Mic92 Jörg Thalheim <joerg@thalheim.io>
-
@zowoq zowoq
-
@NickCao Nick Cao <nickcao@nichi.co>
-
@sumnerevans Sumner Evans <me@sumnerevans.com>
-
@teutat3s teutat3s <teutates@mailbox.org>
-
@skowalak Sebastian Kowalak
-
@transcaffeine transcaffeine <transcaffeine@finally.coffee>
-
@Ma27 Maximilian Bosch <maximilian@mbosch.me>
-
@D4ndellion Daniel Olsen <daniel@dodsorf.as>
-
@nvmd Sergey Kazenyuk <kazenyuk@pm.me>
-
@cpages Carles Pagès <page@ruiec.cat>
-
@dschrempf Dominik Schrempf <dominik.schrempf@gmail.com>
-
@minijackson Rémi Nicole <minijackson@riseup.net>
-
@aanderse Aaron Andersen <aaron@fosslib.net>
-
@peterhoeg Peter Hoeg <peter@hoeg.com>
-
@seb314 Sebastian <sebastian@seb314.com>
-
@Erethon Dionysis Grigoropoulos <dgrig@erethon.com>
-
@ilkecan ilkecan bozdogan <ilkecan@protonmail.com>
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
-
@nyabinary Niko Cantero <nyanbinary@keemail.me>
-
@snaakey emily <ek@kyouma.net>
-
@bartoostveen Bart Oostveen <bart@bartoostveen.nl>
-
@judgeNotFound Robert Richter <robert.richter@rrcomtech.com>
-
@rhysmdnz Rhys Davies <rhys@memes.nz>
-
@johnrtitor Masum Reza <masumrezarock100@gmail.com>
-
@winterqt Winter <nixos@winter.cafe>
-
@liberodark liberodark <liberodark@gmail.com>
-
@symphorien Guillaume Girol <symphorien_nixpkgs@xlumurb.eu>
-
@tilpner Till Höppner <nixpkgs@tilpner.com>
-
@maralorn maralorn <mail@maralorn.de>
-
@thielema Henning Thielemann <nix@henning-thielemann.de>
-
@phanirithvij Phani Rithvij <phanirithvij2000@gmail.com>
-
@eljamm Fedi Jamoussi <fedi.jamoussi@protonmail.ch>
-
@Prince213 Sizhe Zhao <prc.zhao@outlook.com>
-
@ethancedwards8 Ethan Carter Edwards <ethan@ethancedwards.com>
-
@olejorgenb Ole Jørgen Brønner <olejorgenb@yahoo.no>
-
@honnip Jung seungwoo <me@honnip.page>
-
@kurogeek kurogeek <kurogeek@lmvhaus.com>
-
@magnetophon Bart Brouns <bart@magnetophon.nl>