CVE-2026-100543— OpenClaw before 2026.8.1 Information Disclosure via Configuration Hash
Quick assessment
Affected
OpenClaw OpenClaw
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenClaw（npm 包 openclaw）在 2026.8.1 版本之前，在向返回已脱敏（redacted）配置信息的响应中，可能包含基于原始未脱敏配置计算得出的确定性哈希值。当网关（Gateway）密码的熵值较低，且其余配置值可被重构时，这些哈希值实际上充当了离线密码验证器：攻击者若能获取已脱敏的配置信息（例如通过 config.get 方法），即可在不经过速率受限的网关认证路径的情况下，离线测试各种密码候选值。成功恢复密码后，攻击者可能获得文档中所述的可共享密钥的操作员权限。此类问题不影响对密钥引用（se
Possible ATT&CK Techniques 1 AI
T1110.003 · Password Spraying
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100543
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenClaw before 2026.8.1 Information Disclosure via Configuration Hash
Source: CVE Program / CVE List V5
Vulnerability Description
OpenClaw (npm package openclaw) before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. When the Gateway password had low entropy and the remaining configuration values were reconstructable, these hashes acted as offline password verifiers: a caller able to obtain the redacted configuration (for example via config.get) could test password candidates offline without going through the rate-limited Gateway authentication path. Recovering the password could grant the documented shared-secret operator authority. Secret references were not affected in the same way. The issue is fixed in 2026.8.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-100543
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100543
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-100543 (2)
Same Patch Batch · OpenClaw · 2026-09-26 · 79 CVEs total
| CVE-2026-100575 | 8.8 HIGH | OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM |
| CVE-2026-100599 | 8.8 HIGH | OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome |
| CVE-2026-100580 | 8.8 HIGH | OpenClaw before 2026.7.1 Remote Code Execution via cron tool |
| CVE-2026-100586 | 8.8 HIGH | OpenClaw Codex before 2026.7.1 Authorization Bypass via Bind |
| CVE-2026-100544 | 8.8 HIGH | openclaw voice-call before 2026.8.1 Authorization Bypass |
| CVE-2026-100552 | 8.8 HIGH | OpenClaw before 2026.8.1 Policy Bypass via Native Tools |
| CVE-2026-100587 | 8.8 HIGH | OpenClaw before 2026.7.1 Authorization Bypass via Codex Install |
| CVE-2026-100596 | 8.8 HIGH | OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration |
| CVE-2026-100551 | 8.3 HIGH | OpenClaw iOS Control UI TLS Pin Enforcement Bypass |
| CVE-2026-100568 | 8.3 HIGH | OpenClaw before 2026.8.1 Unauthorized Command Job Access |
| CVE-2026-100557 | 8.3 HIGH | OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch |
| CVE-2026-100588 | 8.3 HIGH | OpenClaw before 2026.7.1 Authentication Bypass via node.invoke |
| CVE-2026-100589 | 8.3 HIGH | OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node |
| CVE-2026-100567 | 8.2 HIGH | OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname |
| CVE-2026-100532 | 8.1 HIGH | openclaw WhatsApp before 2026.8.1 Authentication Bypass |
| CVE-2026-100585 | 8.0 HIGH | OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel |
| CVE-2026-100559 | 8.0 HIGH | OpenClaw before 2026.8.1 Command Injection via Escaped Newlines |
| CVE-2026-100561 | 8.0 HIGH | OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper |
| CVE-2026-100570 | 7.8 HIGH | OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS |
| CVE-2026-100597 | 7.8 HIGH | OpenClaw before 2026.7.1 Path Traversal via Filesystem Race |
Showing top 20 of 79 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: OpenClaw
-
CVE-2026-100599
OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via -
CVE-2026-100598
OpenClaw before 2026.7.1 Approval Binding Logic Error -
CVE-2026-100597
OpenClaw before 2026.7.1 Path Traversal via Filesystem Race -
CVE-2026-100596
OpenClaw before 2026.7.1 Authorization Bypass via MCP Config -
CVE-2026-100594
OpenClaw before 2026.7.1 Authorization Bypass via trajectory
Same vendor: OpenClaw
-
CVE-2026-100604
ClawHub Authentication Bypass via Former Publisher Skill Con -
CVE-2026-100603
ClawHub before 8c2de6c506 Skill Hiding via Coordinated Repor -
CVE-2026-100602
ClawHub Changelog Preview Information Disclosure via Authori -
CVE-2026-100600
ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API -
CVE-2026-100601
ClawHub SSRF via Unchecked DNS Resolution in Profile Image
Same weakness: CWE-200
-
CVE-2026-101092
SiYuan before v3.8.4 Information Disclosure via getCurrentAt -
CVE-2026-101146
Eleveo Quality Management GWT RPC QMUtilsService UtilsServic -
CVE-2026-102267
PyJWT: PyJWKClient follows redirects when fetching JWKS -
CVE-2026-101143
Eleveo Quality Management QMBODownload information disclosur -
CVE-2026-101083
PMWeb encryptionhelper.dll information disclosure
V. Comments for CVE-2026-100543
No comments yet