Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck
CVE-2026-100534OpenClaw before 2026.8.1 Session Cancellation Authorization Bypass
Low 3.1
In plain English
A low-severity authorization bypass via user-controlled key in OpenClaw from OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.3%top 81.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel ACP or subagent work outside the route's configured authority.
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
References
- GitHub Security Advisory (GHSA-g24w-m94m-59qc) vendor-advisory
- VulnCheck Advisory: OpenClaw before 2026.8.1 Session Cancellation Authorization Bypass third-party-advisory