CVE-2026-100599— OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome
Quick assessment
Affected
OpenClaw OpenClaw
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenClaw 2026.5.1 至 2026.7.0 版本未将配置的执行审批路径应用于 Google Meet 节点命令。其中，googlemeet.chrome 命令接受由调用方提供的音频命令数组，并在成对的节点上直接执行这些命令，而未经过正常的 system.run 审批流程。在启用了 Google Meet 插件、存在成对的 Chrome 节点，并且允许使用 googlemeet.chrome 节点命令的部署环境中，具备工具调用能力的代理若能够调用该命令，即可在成对节点上执行攻击者指定的进程，从而影响该节
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100599
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome
Source: CVE Program / CVE List V5
Vulnerability Description
OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In deployments with the Google Meet plugin enabled, a paired Chrome node, and the googlemeet.chrome node command allowed, a tool-enabled agent able to invoke that command can execute attacker-selected processes on the paired node, impacting files, credentials, browser profiles, and availability on that node. The issue is fixed in 2026.7.1; as a workaround, remove googlemeet.chrome from allowed node commands or disable the Google Meet plugin.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-100599
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100599
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-100599 (1)
Other References for CVE-2026-100599 (1)
Same Patch Batch · OpenClaw · 2026-09-26 · 79 CVEs total
| CVE-2026-100587 | 8.8 HIGH | OpenClaw before 2026.7.1 Authorization Bypass via Codex Install |
| CVE-2026-100544 | 8.8 HIGH | openclaw voice-call before 2026.8.1 Authorization Bypass |
| CVE-2026-100580 | 8.8 HIGH | OpenClaw before 2026.7.1 Remote Code Execution via cron tool |
| CVE-2026-100575 | 8.8 HIGH | OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM |
| CVE-2026-100596 | 8.8 HIGH | OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration |
| CVE-2026-100586 | 8.8 HIGH | OpenClaw Codex before 2026.7.1 Authorization Bypass via Bind |
| CVE-2026-100552 | 8.8 HIGH | OpenClaw before 2026.8.1 Policy Bypass via Native Tools |
| CVE-2026-100551 | 8.3 HIGH | OpenClaw iOS Control UI TLS Pin Enforcement Bypass |
| CVE-2026-100589 | 8.3 HIGH | OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node |
| CVE-2026-100588 | 8.3 HIGH | OpenClaw before 2026.7.1 Authentication Bypass via node.invoke |
| CVE-2026-100557 | 8.3 HIGH | OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch |
| CVE-2026-100568 | 8.3 HIGH | OpenClaw before 2026.8.1 Unauthorized Command Job Access |
| CVE-2026-100567 | 8.2 HIGH | OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname |
| CVE-2026-100532 | 8.1 HIGH | openclaw WhatsApp before 2026.8.1 Authentication Bypass |
| CVE-2026-100559 | 8.0 HIGH | OpenClaw before 2026.8.1 Command Injection via Escaped Newlines |
| CVE-2026-100561 | 8.0 HIGH | OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper |
| CVE-2026-100585 | 8.0 HIGH | OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel |
| CVE-2026-100570 | 7.8 HIGH | OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS |
| CVE-2026-100597 | 7.8 HIGH | OpenClaw before 2026.7.1 Path Traversal via Filesystem Race |
| CVE-2026-100579 | 7.6 HIGH | OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester |
Showing top 20 of 79 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: OpenClaw
-
CVE-2026-100598
OpenClaw before 2026.7.1 Approval Binding Logic Error -
CVE-2026-100597
OpenClaw before 2026.7.1 Path Traversal via Filesystem Race -
CVE-2026-100596
OpenClaw before 2026.7.1 Authorization Bypass via MCP Config -
CVE-2026-100594
OpenClaw before 2026.7.1 Authorization Bypass via trajectory -
CVE-2026-100595
OpenClaw before 2026.7.1 Authorization Bypass via diagnostic
Same vendor: OpenClaw
-
CVE-2026-100604
ClawHub Authentication Bypass via Former Publisher Skill Con -
CVE-2026-100603
ClawHub before 8c2de6c506 Skill Hiding via Coordinated Repor -
CVE-2026-100602
ClawHub Changelog Preview Information Disclosure via Authori -
CVE-2026-100600
ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API -
CVE-2026-100601
ClawHub SSRF via Unchecked DNS Resolution in Profile Image
Same weakness: CWE-78
-
CVE-2026-101075
Netcore NR289-GE Location Time location_time.cgi system os c -
CVE-2026-4556
macOS Exam4 Local Privilege Escalation via Command Injection -
CVE-2026-101072
Netcore NR289-GE CGI ap_ip.cgi system os command injection -
CVE-2026-86330
Noobaa-core: noobaa-core: os command injection in cluster_in -
CVE-2026-78424
OS Command Injection in Packet-Capture (Sniffer) Filter lead
V. Comments for CVE-2026-100599
No comments yet