CVE-2026-100585— OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel
Quick assessment
Affected
OpenClaw OpenClaw
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenClaw（npm 包 ）在 2026.7.1 版本之前，未能强制执行仅允许所有者审批的 Claude Code 权限提示授权要求，这些提示通过 MCP 通道桥接传递。具有通道命令访问权限的已认证非所有者通道发送者，可以批准或拒绝本应由所有者处理的待处理权限请求，从而导致请求的操作在未经所有者同意的情况下继续执行。实际影响取决于待处理的操作以及 Claude Code 运行时请求的主机能力。该问题已在 2026.7.1 版本中修复。
Possible ATT&CK Techniques 1 AI
T1078.004 · Cloud Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100585
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel
Source: CVE Program / CVE List V5
Vulnerability Description
OpenClaw (npm package `openclaw`) before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel command access can approve or deny a pending permission request intended for the owner, causing the requested action to proceed without owner consent. The practical impact depends on the pending action and the host capabilities requested by the Claude Code run. The issue is fixed in version 2026.7.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-100585
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100585
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-100585 (1)
Other References for CVE-2026-100585 (1)
Same Patch Batch · OpenClaw · 2026-09-26 · 79 CVEs total
| CVE-2026-100580 | 8.8 HIGH | OpenClaw before 2026.7.1 Remote Code Execution via cron tool |
| CVE-2026-100575 | 8.8 HIGH | OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM |
| CVE-2026-100544 | 8.8 HIGH | openclaw voice-call before 2026.8.1 Authorization Bypass |
| CVE-2026-100599 | 8.8 HIGH | OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome |
| CVE-2026-100586 | 8.8 HIGH | OpenClaw Codex before 2026.7.1 Authorization Bypass via Bind |
| CVE-2026-100587 | 8.8 HIGH | OpenClaw before 2026.7.1 Authorization Bypass via Codex Install |
| CVE-2026-100596 | 8.8 HIGH | OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration |
| CVE-2026-100552 | 8.8 HIGH | OpenClaw before 2026.8.1 Policy Bypass via Native Tools |
| CVE-2026-100588 | 8.3 HIGH | OpenClaw before 2026.7.1 Authentication Bypass via node.invoke |
| CVE-2026-100568 | 8.3 HIGH | OpenClaw before 2026.8.1 Unauthorized Command Job Access |
| CVE-2026-100551 | 8.3 HIGH | OpenClaw iOS Control UI TLS Pin Enforcement Bypass |
| CVE-2026-100589 | 8.3 HIGH | OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node |
| CVE-2026-100557 | 8.3 HIGH | OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch |
| CVE-2026-100567 | 8.2 HIGH | OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname |
| CVE-2026-100532 | 8.1 HIGH | openclaw WhatsApp before 2026.8.1 Authentication Bypass |
| CVE-2026-100559 | 8.0 HIGH | OpenClaw before 2026.8.1 Command Injection via Escaped Newlines |
| CVE-2026-100561 | 8.0 HIGH | OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper |
| CVE-2026-100597 | 7.8 HIGH | OpenClaw before 2026.7.1 Path Traversal via Filesystem Race |
| CVE-2026-100570 | 7.8 HIGH | OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS |
| CVE-2026-100579 | 7.6 HIGH | OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester |
Showing top 20 of 79 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: OpenClaw
-
CVE-2026-100599
OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via -
CVE-2026-100598
OpenClaw before 2026.7.1 Approval Binding Logic Error -
CVE-2026-100597
OpenClaw before 2026.7.1 Path Traversal via Filesystem Race -
CVE-2026-100596
OpenClaw before 2026.7.1 Authorization Bypass via MCP Config -
CVE-2026-100594
OpenClaw before 2026.7.1 Authorization Bypass via trajectory
Same vendor: OpenClaw
-
CVE-2026-100604
ClawHub Authentication Bypass via Former Publisher Skill Con -
CVE-2026-100603
ClawHub before 8c2de6c506 Skill Hiding via Coordinated Repor -
CVE-2026-100602
ClawHub Changelog Preview Information Disclosure via Authori -
CVE-2026-100600
ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API -
CVE-2026-100601
ClawHub SSRF via Unchecked DNS Resolution in Profile Image
Same weakness: CWE-862
-
CVE-2026-86335
LXD Cross-Project Private Image Theft via Unsanitized GetIma -
CVE-2026-82377
Apache Roller: Missing weblog authorization in XML-RPC Blogg -
CVE-2026-101000
Netcore NBR100V2 ACL unauthenticated.json uci.apply authoriz -
CVE-2026-96283
Flatpak: flatpak: flatpak-system-helper cross-user cancelpul -
CVE-2026-101063
Obot before v0.23.0 Authentication Bypass via Registry API
V. Comments for CVE-2026-100585
No comments yet