Incorrect authorization in OpenClaw - CVE-2026-100562
Published: November 3, 2026
Vulnerability identifier: #VU158812
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-100562
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass administrator authorization to modify an existing session's configuration and potentially redirect subsequent session traffic.
The vulnerability exists due to incorrect authorization in OpenClaw's Gateway sessions.create method when processing keyed requests to reconfigure an existing session. A remote user can use operator.write credentials to submit an existing session key with model or thinking changes to modify the session's model, provider, thinking level, and configured auth-profile selection without the operator.admin scope required by sessions.patch.
Changes are limited to models and credentials already configured by the operator.
Affected software
OpenClaw
How to mitigate CVE-2026-100562
Install security update from vendor's website.
OpenClaw - update to 2026.8.1