Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-100587: OpenClaw lets non‑owners install plugins
CVE-2026-100587 · published 18 days ago
Summary
Versions of OpenClaw released before 2026.7.1 do not check who is requesting a plugin installation. This means anyone can add malicious plugins or run code with the same rights as the OpenClaw service, potentially exposing or disrupting your systems. Update OpenClaw to version 2026.7.1 or later to fix the problem.
What to do
- Update openclaw openclaw to version 2026.7.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| openclaw | openclaw | < 2026.7.1 |
Original advisory text
OpenClaw before 2026.7.1 Authorization Bypass via Codex Install
OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can install arbitrary plugins and execute MCP processes with OpenClaw user privileges, affecting host confidentiality, integrity, and availability.
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-pjjr-5qhr-5w6r
- https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authorization-bypa...
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-1005... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-100587 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.7
High
Type
CWE-862Missing Authorization
Timeline
Published26 Sep 2026
Updated14 Oct 2026
First seen26 Sep 2026
Sources
CVE-2026-100587 · NVD
CVE-2026-100587 · MITRE
CVE-2026-100587 · OSV
GHSA-pjjr-5qhr-5w6r · GHSA
Track software like this
Free during beta