Authorization bypass through user-controlled key in OpenClaw - CVE-2026-100534
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote user to cancel unrelated sessions and disrupt ACP or subagent work outside a webhook route's authority.
The vulnerability exists due to authorization bypass through a user-controlled key in the webhook TaskFlow cancellation route when processing child session identifiers without verifying that they belong to the route's configured parent session. A remote user can supply a known live child session key belonging to another session through a route whose secret they hold, then trigger cancellation to stop unrelated work.
The demonstrated effect was limited to session cancellation and associated task-state changes; it did not provide access to the cancelled session's content.