Resource exhaustion in OpenClaw - CVE-2026-100542
Published: November 3, 2026
Vulnerability identifier: #VU158802
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-100542
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by bypassing archive extraction limits and consuming disk space or inodes.
The vulnerability exists due to uncontrolled resource consumption in the OpenClaw tar.bz2 skill installer when bounded command-output suffixes are treated as complete archive listings. A remote attacker can craft a skill archive that pushes prohibited entries outside both retained listings and persuade an operator to approve its installation to bypass entry-count and size checks, causing over-limit contents to be extracted into the skill tools directory.
The demonstrated issue does not execute archive contents by itself.
Affected software
OpenClaw
How to mitigate CVE-2026-100542
Install security update from vendor's website.
OpenClaw - update to 2026.8.1