SB2026091218 - Multiple vulnerabilities in OpenClaw

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091218

SB2026091218 - Multiple vulnerabilities in OpenClaw

Published: September 12, 2026 Updated: November 10, 2026

Security Bulletin ID SB2026091218
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 33
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 30% Low 70%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 33 vulnerabilities.


1) Improper Neutralization of Formula Elements in a CSV File (CVE-ID: CVE-2026-100563)

CWE-ID: CWE-1236 - Improper Neutralization of Formula Elements in a CSV File

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject spreadsheet formulas into Usage CSV exports, potentially disclosing information or modifying spreadsheet data when an operator opens the export.

The vulnerability exists due to improper neutralization of formula-leading characters in the OpenClaw Control UI Usage CSV export when exporting session labels. A remote attacker can influence a session label or first user message to insert a formula-like cell that is evaluated with the spreadsheet user's permissions when an operator opens the export in spreadsheet software with formula evaluation enabled.

OpenClaw does not evaluate the formulas itself; practical impact depends on the spreadsheet application's security settings and formula support.


2) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-100555)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to make a NAS fetch private or policy-denied resources and disclose their contents to an addressed Synology Chat conversation.

The vulnerability exists due to loss of DNS pinning in OpenClaw's Synology Chat attachment delivery when forwarding a remotely influenced file URL to a NAS. A remote user can use DNS rebinding to make the original hostname resolve to a different destination on the NAS than the address validated by the Gateway, causing the NAS to fetch a private or policy-denied resource and return its contents to the conversation.

Practical impact depends on NAS routing, resolver behavior, and the response available at the private destination.


3) Incorrect authorization (CVE-ID: CVE-2026-100556)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass command authorization and change provider routing, cost, data flow, or availability for a shared WhatsApp group session.

The vulnerability exists due to incorrect authorization in OpenClaw's WhatsApp group session reset handling when processing /new <model> commands. A remote user can send this command as a group member admitted for ordinary messages but denied by commands.allowFrom or owner command authorization to reset the shared session and persist an unauthorized provider and model override for later turns.

Provider and model selection is restricted to those already allowed by the operator; exploitation does not add a provider or grant host execution.


4) Incorrect authorization (CVE-ID: CVE-2026-100557)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass owner-only restrictions and access tools backed by server credentials and capabilities reserved for owners.

The vulnerability exists due to incorrect authorization in OpenClaw's skill tool dispatch when handling skill-backed commands without carrying the sender's owner status or applying the owner-only tool filter. A remote user can invoke an allowlisted skill-backed command as a non-owner to access owner-only tools exposed by the installed skill.

Practical impact depends on which owner-only command tool the installed skill exposes.


5) Improper Resource Shutdown or Release (CVE-ID: CVE-2026-100558)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by exhausting Gateway listener resources.

The vulnerability exists due to improper resource shutdown or release in the OpenClaw Gateway's ordinary HTTP handler when processing requests carrying a WebSocket upgrade header without matching connection semantics. A remote attacker can repeatedly send these requests to retain response sockets and associated request state without consuming the WebSocket pre-auth connection budget, exhausting listener resources because the handler returns without ending the responses.


6) OS Command Injection (CVE-ID: CVE-2026-100559)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute additional operating system commands without the expected approval prompt.

The vulnerability exists due to improper handling of escaped newlines in OpenClaw's exec command parser when evaluating commands against an allowlist or approval policy. A remote user can supply lower-trust model input containing escaped newlines so that the parser authorizes one visible shell word sequence while execution includes an additional hidden command, bypassing the expected approval prompt.


7) Incorrect authorization (CVE-ID: CVE-2026-100560)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass command approval prompts and potentially disclose local files, overwrite user-writable files, or access internal services.

The vulnerability exists due to incorrect authorization in OpenClaw's reusable exec approval mechanism when an operator's Allow Always approval for an exact command is persisted as a path-only grant. A remote attacker can influence the agent through untrusted content to reuse the previously approved executable with different target or output arguments to perform unauthorized operations without another approval prompt.

The issue is limited to generated Allow Always entries on macOS and Linux; operator-authored path-only allowlist rules are outside the advisory's scope.


8) Argument injection (CVE-ID: CVE-2026-100561)

CWE-ID: CWE-88 - Argument Injection or Modification

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary commands with the OpenClaw process's host privileges outside the operator's reviewed approval.

The vulnerability exists due to insufficient validation of command-bearing wrapper arguments in OpenClaw's exec approval policy when evaluating a wrapper previously allowlisted or permanently approved by an operator. A remote user can substitute an arbitrary inner command in a subsequent agent turn to execute commands without another approval prompt.

Exploitation requires the relevant wrapper to resolve on the host.


9) Incorrect authorization (CVE-ID: CVE-2026-100562)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass administrator authorization to modify an existing session's configuration and potentially redirect subsequent session traffic.

The vulnerability exists due to incorrect authorization in OpenClaw's Gateway sessions.create method when processing keyed requests to reconfigure an existing session. A remote user can use operator.write credentials to submit an existing session key with model or thinking changes to modify the session's model, provider, thinking level, and configured auth-profile selection without the operator.admin scope required by sessions.patch.

Changes are limited to models and credentials already configured by the operator.


10) Insufficient Session Expiration (CVE-ID: CVE-2026-100554)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to retain unauthorized access to Canvas resources after node revocation, potentially reading or modifying data within the previously granted capability's scope.

The vulnerability exists due to insufficient session expiration in OpenClaw's Canvas HTTP authorization when a paired node is revoked during WebSocket disconnection. A remote user can continue sending HTTP requests using the previously granted Canvas capability, which remains accepted and renewable until connection cleanup finishes, to access resources after authorization has been revoked.

Access is limited to the capability's configured routes and the short WebSocket close grace period.


11) Incorrect authorization (CVE-ID: CVE-2026-100545)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to bypass sender tool restrictions and create persistent scheduled work.

The vulnerability exists due to incorrect authorization in OpenClaw's session-memory filename generation, whose helper exposes tools removed by the originating sender's policy when the feature is enabled for agents reachable by lower-trust senders. A low-privileged remote attacker can inject instructions that invoke those tools if the model follows them.


12) Incorrect Behavior Order: Validate Before Canonicalize (CVE-ID: CVE-2026-100547)

CWE-ID: CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated local attacker to read host files outside the session working directory without approval.

The vulnerability exists due to OpenClaw's ACP client treating alternate valid file: URL spellings as relative paths during working-directory approval checks. An unauthenticated local attacker controlling an ACP peer can submit these URLs to obtain file contents when an operator connects the OpenClaw ACP client to that peer.


13) Information disclosure (CVE-ID: CVE-2026-100548)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to obtain an API key intended for a different embedding provider.

The vulnerability exists due to OpenClaw's memory embedding fallback reusing the primary provider's configured credential when that provider fails and remote cross-provider fallback is enabled. An unauthenticated remote attacker can receive the key as a bearer token if they operate the fallback provider selected by the user.


14) Path traversal (CVE-ID: CVE-2026-100549)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker with low privileges to write attacker-controlled bytes outside OpenClaw's intended voice staging directory.

The vulnerability exists due to double decoding of attachment filenames in QQBot voice forwarding, which restores encoded traversal segments after filename sanitization. A remote attacker with low privileges can supply a crafted QQ attachment that the agent forwards as voice to write to another process-writable location, although generated filename material limits targeted overwrites.


15) Incorrect authorization (CVE-ID: CVE-2026-100550)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker who is an unlisted Microsoft Teams member to trigger OpenClaw's configured agent despite administrator-defined group restrictions.

The vulnerability exists due to Teams message admission failing to reject denied results from missing or unsupported access groups when groupPolicy is set to allowlist. A low-privileged remote attacker can send a Teams message that bypasses the configured group boundary and invokes the agent.


16) Incorrect authorization (CVE-ID: CVE-2026-100552)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to bypass per-chat tool restrictions and execute commands or access host files.

The vulnerability exists due to incomplete authorization in OpenClaw when a lower-trust conversation assigned to a Codex runtime uses a tools.allow rule that restricts OpenClaw tools but not native runtime tools. A low-privileged remote attacker can trigger the conversation's agent to invoke native command and file tools within the runtime's host permissions and sandbox constraints.


17) Incorrect authorization (CVE-ID: CVE-2026-100553)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to bypass OpenClaw's cross-context message mutation policy and remove pins from another Feishu group.

The vulnerability exists due to missing cross-context target validation in the Feishu unpin action when tools.message.crossContext.allowWithinProvider is disabled. A low-privileged remote attacker can submit an unpin request as an admitted sender targeting another group that both the sender and configured account are authorized to access, removing a pin despite the policy.


18) Information disclosure (CVE-ID: CVE-2026-100528)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose configured third-party provider credentials to an unrelated provider endpoint.

The vulnerability exists due to improper endpoint selection in the OpenAI-compatible transport when a pinned third-party provider session continues after model configuration is reloaded without a concrete provider base URL. A remote user can cause a request to be sent to the default endpoint with the retained provider credential to disclose configured third-party provider credentials to an unrelated provider endpoint.

User interaction is required.


19) Information disclosure (CVE-ID: CVE-2026-100543)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to recover a Gateway password and potentially gain shared-secret operator authority.

The vulnerability exists due to exposure of deterministic hashes of unredacted configuration data in OpenClaw configuration responses when returning redacted configuration. A remote user can obtain these hashes and test password candidates offline, bypassing the rate-limited Gateway authentication path, to recover the Gateway password and potentially gain shared-secret operator authority.

Practical exploitation requires a weak password and sufficient knowledge of every other hashed configuration value. Secret references are not affected in the same way.


20) Resource exhaustion (CVE-ID: CVE-2026-100542)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by bypassing archive extraction limits and consuming disk space or inodes.

The vulnerability exists due to uncontrolled resource consumption in the OpenClaw tar.bz2 skill installer when bounded command-output suffixes are treated as complete archive listings. A remote attacker can craft a skill archive that pushes prohibited entries outside both retained listings and persuade an operator to approve its installation to bypass entry-count and size checks, causing over-limit contents to be extracted into the skill tools directory.

The demonstrated issue does not execute archive contents by itself.


21) Improper Handling of Case Sensitivity (CVE-ID: CVE-2026-100541)

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges by inheriting authorization granted to another Matrix account.

The vulnerability exists due to improper handling of case sensitivity in OpenClaw's Matrix authorization component when normalizing complete user IDs. A remote user can use a protocol-valid account identifier that differs from another account's identifier only by characters OpenClaw folds to inherit that account's allowlist, owner-command, exec-approval, or plugin-approval authority.


22) Incorrect authorization (CVE-ID: CVE-2026-100540)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read or modify Feishu resources using an identity the operator intended to revoke.

The vulnerability exists due to incorrect authorization in the Feishu model tools' default account selection when processing tool invocations without checking whether the selected account is disabled. A remote user can invoke a tool using the disabled default account's retained credentials to read or modify Feishu resources.

Exploitation requires a multi-account configuration with a disabled default account and an enabled sibling account that keeps the relevant tool family available. Available actions are limited by the disabled app's scopes and the enabled tool families.


23) Incorrect authorization (CVE-ID: CVE-2026-100539)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access durable memory after an operator has revoked access.

The vulnerability exists due to incorrect authorization in the execution-time resolver for memory_search and memory_get when an operator disables memory during an already-running agent turn. A remote user can use previously created tools that restore stale enabled configuration to continue searching or reading durable memory for the remainder of the affected run.


24) Incorrect authorization (CVE-ID: CVE-2026-100538)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose local file contents despite requester-specific filesystem read denials.

The vulnerability exists due to incorrect authorization in OpenClaw's outbound attachment handling when processing local file attachments without applying the originating sender's global or per-agent toolsBySender policy. A remote user can reference a host file through a final-response media directive or message attachment to retrieve its contents despite being denied access to the read tool.

Exploitation requires knowledge or derivation of a useful file path and a delivery flow that accepts local attachments.


25) Missing Authorization (CVE-ID: CVE-2026-100537)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to obtain information derived from durable memory despite requester-specific rules denying access to memory tools.

The vulnerability exists due to missing authorization in OpenClaw's Active Memory context assembly when automatic recall retrieves and injects durable memory without applying the originating requester's effective tool policy. A remote user can submit requests as an admitted sender denied memory_search and memory_get access to receive information derived from durable memory in the agent's response.


26) Path traversal (CVE-ID: CVE-2026-100536)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose host files outside the sandbox through Telegram attachment delivery.

The vulnerability exists due to incomplete path validation in OpenClaw's structured message attachment handling when processing attachments with multiple populated source fields. A remote user can place an out-of-sandbox host path behind an allowed attachment source to cause Telegram delivery to read and send a host file, because validation checks only the first populated source while delivery processes every populated source.

Exploitation requires a known, useful host file path and an allowed Telegram delivery target. The vulnerability does not provide general filesystem listing.


27) Incorrect authorization (CVE-ID: CVE-2026-100535)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to exceed sender restrictions and potentially access or modify files, execute commands, or affect services using a background agent's broader authority.

The vulnerability exists due to incorrect authorization in OpenClaw's session-memory and dreaming processing when persisted content loses its originating requester's restrictions and untrusted provenance. A remote user can submit instructions through a restricted sender session that, if captured, selected for later processing, and followed by the background model, cause actions beyond the original sender's permitted capabilities.

Exploitation requires a deployment with both session-memory capture and dreaming enabled.


28) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-100534)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cancel unrelated sessions and disrupt ACP or subagent work outside a webhook route's authority.

The vulnerability exists due to authorization bypass through a user-controlled key in the webhook TaskFlow cancellation route when processing child session identifiers without verifying that they belong to the route's configured parent session. A remote user can supply a known live child session key belonging to another session through a route whose secret they hold, then trigger cancellation to stop unrelated work.

The demonstrated effect was limited to session cancellation and associated task-state changes; it did not provide access to the cancelled session's content.


29) Missing Authorization (CVE-ID: CVE-2026-100532)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disconnect or replace the Gateway's WhatsApp account, causing a denial of service or unauthorized account relinking.

The vulnerability exists due to missing authorization in the WhatsApp login tool when invoked through the generic channel-tool path without preserving the originating sender's owner status. A remote user can steer an admitted non-owner turn to request a forced login and obtain a new QR code for a configured account to disconnect the account or initiate unauthorized relinking.

Successful account takeover requires scanning the returned QR code with another phone. The affected boundary is the owner-only tool restriction, not WhatsApp transport authentication.


30) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-100531)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose Slack file contents outside authorized conversation boundaries.

The vulnerability exists due to authorization checks that fail open in the Slack download-file operation when processing files without the share metadata needed to verify their relationship to the requested conversation. A remote user can request a file using a known file identifier to retrieve its contents outside the configured conversation scope.

The issue does not permit listing arbitrary Slack files or bypassing Slack authentication.


31) Incorrect Behavior Order: Validate Before Canonicalize (CVE-ID: CVE-2026-100533)

CWE-ID: CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to incorrect behavior order: validate before canonicalize in the tools.fs.workspaceOnly Unicode filename fallback when retrying a missing path within the configured workspace. A remote user can request access to a known file outside the configured workspace boundary to disclose sensitive information.

Exploitation requires distinct canonically equivalent sibling directory names on the filesystem and knowledge of a useful target path; it does not rely on symlinks or hardlinks.


32) Incorrect authorization (CVE-ID: CVE-2026-100530)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access or modify unreviewed files or repositories.

The vulnerability exists due to incorrect authorization in reusable exec approvals when reusing an approved command in a different working directory. A remote user can obtain an allow-always approval for a command and reuse it in a directory with materially different read or write effects to access or modify unreviewed files or repositories.

User interaction is required for the operator's initial approval.


33) Incorrect authorization (CVE-ID: CVE-2026-100529)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to broaden durable read or write access.

The vulnerability exists due to incorrect authorization in file-transfer allow-always approvals when reusing a standing grant for a sibling path or a different node with the same display name. A remote user can reuse an approved standing grant to broaden durable read or write access.

User interaction is required for an operator to approve the original file-transfer request.


Remediation

Install update from vendor's website.

References