Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-100596: OpenClaw before 2026.7.1 lets non‑owners change settings
CVE-2026-100596 · published 18 days ago
Summary
Versions of OpenClaw released before 2026.7.1 allow users who do not own the system to modify configuration commands. Those changes can run with the program's full privileges, potentially exposing the server to data loss or unauthorized access. Update OpenClaw to version 2026.7.1 or later to restore proper permission checks.
What to do
- Update openclaw openclaw to version 2026.7.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| openclaw | openclaw | < 2026.7.1 |
Original advisory text
OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration
OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Attackers can persist arbitrary stdio MCP commands that execute with OpenClaw process privileges when configuration loads, compromising host confidentiality, integrity, and availability.
References
- https://github.com/openclaw/openclaw/security/advisories/GHSA-wwx7-573h-pqwc
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-1005... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-100596 Vendor Advisory
- https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authorization-bypa...
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.7
High
Type
CWE-862Missing Authorization
Timeline
Published26 Sep 2026
Updated14 Oct 2026
First seen26 Sep 2026
Sources
CVE-2026-100596 · NVD
CVE-2026-100596 · MITRE
CVE-2026-100596 · OSV
GHSA-wwx7-573h-pqwc · GHSA
Track software like this
Free during beta