CVE-2026-100578— OpenClaw before 2026.7.1 Authorization Bypass via chat.send
Quick assessment
Affected
OpenClaw OpenClaw
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenClaw（npm 包 ）在 2026.7.1 版本之前，未能对通过 端点暴露的仅限所有者（owner-only）使用的基础设施工具进行有效限制。在采用身份验证模式的 Gateway 部署中，若该模式支持识别调用者身份并支持更细粒度的操作员权限范围，则拥有“写入”权限的非所有者调用者可以启动一个聊天轮次（chat turn），其中包含 和 工具。这可能导致代理（agent）执行仅限所有者使用的配置或调度操作，包括持久性状态变更。实际影响程度取决于模型所选用的具体工具以及调用者引导对话轮次的能力。需要注意的是，
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100578
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenClaw before 2026.7.1 Authorization Bypass via chat.send
Source: CVE Program / CVE List V5
Vulnerability Description
OpenClaw (npm package `openclaw`) before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, a write-scoped non-owner caller can start a chat turn whose tool inventory includes the `gateway` and `cron` tools, causing the agent to invoke owner-only configuration or scheduling operations, including persistent state changes. Practical impact depends on the tools selected by the model and the caller's ability to steer the turn. Shared-secret token and password callers are treated as fully trusted operators under OpenClaw's security model and are outside the scope of this issue. The issue is fixed in 2026.7.1; as a workaround, restrict chat.send to administrators in identity-bearing deployments and remove `gateway` and `cron` from affected agent tool policies.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-100578
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100578
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-100578 (1)
Other References for CVE-2026-100578 (1)
Same Patch Batch · OpenClaw · 2026-09-26 · 79 CVEs total
| CVE-2026-100580 | 8.8 HIGH | OpenClaw before 2026.7.1 Remote Code Execution via cron tool |
| CVE-2026-100544 | 8.8 HIGH | openclaw voice-call before 2026.8.1 Authorization Bypass |
| CVE-2026-100599 | 8.8 HIGH | OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome |
| CVE-2026-100596 | 8.8 HIGH | OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration |
| CVE-2026-100587 | 8.8 HIGH | OpenClaw before 2026.7.1 Authorization Bypass via Codex Install |
| CVE-2026-100586 | 8.8 HIGH | OpenClaw Codex before 2026.7.1 Authorization Bypass via Bind |
| CVE-2026-100575 | 8.8 HIGH | OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM |
| CVE-2026-100552 | 8.8 HIGH | OpenClaw before 2026.8.1 Policy Bypass via Native Tools |
| CVE-2026-100588 | 8.3 HIGH | OpenClaw before 2026.7.1 Authentication Bypass via node.invoke |
| CVE-2026-100551 | 8.3 HIGH | OpenClaw iOS Control UI TLS Pin Enforcement Bypass |
| CVE-2026-100557 | 8.3 HIGH | OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch |
| CVE-2026-100589 | 8.3 HIGH | OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node |
| CVE-2026-100568 | 8.3 HIGH | OpenClaw before 2026.8.1 Unauthorized Command Job Access |
| CVE-2026-100567 | 8.2 HIGH | OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname |
| CVE-2026-100532 | 8.1 HIGH | openclaw WhatsApp before 2026.8.1 Authentication Bypass |
| CVE-2026-100561 | 8.0 HIGH | OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper |
| CVE-2026-100559 | 8.0 HIGH | OpenClaw before 2026.8.1 Command Injection via Escaped Newlines |
| CVE-2026-100585 | 8.0 HIGH | OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel |
| CVE-2026-100597 | 7.8 HIGH | OpenClaw before 2026.7.1 Path Traversal via Filesystem Race |
| CVE-2026-100570 | 7.8 HIGH | OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS |
Showing top 20 of 79 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: OpenClaw
-
CVE-2026-100599
OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via -
CVE-2026-100598
OpenClaw before 2026.7.1 Approval Binding Logic Error -
CVE-2026-100597
OpenClaw before 2026.7.1 Path Traversal via Filesystem Race -
CVE-2026-100596
OpenClaw before 2026.7.1 Authorization Bypass via MCP Config -
CVE-2026-100594
OpenClaw before 2026.7.1 Authorization Bypass via trajectory
Same vendor: OpenClaw
-
CVE-2026-100604
ClawHub Authentication Bypass via Former Publisher Skill Con -
CVE-2026-100603
ClawHub before 8c2de6c506 Skill Hiding via Coordinated Repor -
CVE-2026-100602
ClawHub Changelog Preview Information Disclosure via Authori -
CVE-2026-100600
ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API -
CVE-2026-100601
ClawHub SSRF via Unchecked DNS Resolution in Profile Image
Same weakness: CWE-269
-
CVE-2026-101086
Nezha Dashboard before 2.3.5 Task Type Validation Bypass -
CVE-2026-77203
Groups <= 4.6.0 - Authenticated (Subscriber+) Privilege Esca -
CVE-2026-100686
Budibase before 3.45.0 Cross-Workspace Privilege Escalation -
CVE-2026-100620
Capgo CLI through 7.98.2 Excessive Permissions via Overpermi -
CVE-2026-100615
Cap-go capgo.app before 12.267.1 Privilege Escalation via AP
V. Comments for CVE-2026-100578
No comments yet