Incorrect authorization in OpenClaw - CVE-2026-100530
Published: September 12, 2026 / Updated: September 28, 2026
Vulnerability identifier: #VU149037
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-100530
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to access or modify unreviewed files or repositories.
The vulnerability exists due to incorrect authorization in reusable exec approvals when reusing an approved command in a different working directory. A remote user can obtain an allow-always approval for a command and reuse it in a directory with materially different read or write effects to access or modify unreviewed files or repositories.
User interaction is required for the operator's initial approval.
Affected software
OpenClaw
How to mitigate CVE-2026-100530
Install security update from vendor's website.
OpenClaw - update to 2026.8.1