Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.3
CVE-2026-100534: OpenClaw before 2026.8.1 allows unauthorized session cancellation
CVE-2026-100534 · published 23 days ago
Summary
Versions of OpenClaw released before 2026.8.1 let anyone who knows a webhook secret cancel work sessions they shouldn't control. This could disrupt automated processes or stop tasks that the attacker is not authorized to affect. Update OpenClaw to version 2026.8.1 or later, or restrict webhook secret access, to stop the risk.
What to do
- Update openclaw openclaw to version 2026.8.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| openclaw | openclaw | < 2026.8.1 |
Original advisory text
OpenClaw before 2026.8.1 Session Cancellation Authorization Bypass
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel ACP or subagent work outside the route's configured authority.
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-g24w-m94m-59qc
- https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-session-cancellati...
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-1005... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-100534 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.3
Low
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published26 Sep 2026
Updated19 Oct 2026
First seen26 Sep 2026
Sources
CVE-2026-100534 · NVD
CVE-2026-100534 · MITRE
CVE-2026-100534 · OSV
GHSA-g24w-m94m-59qc · GHSA
Track software like this
Free during beta