Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck
CVE-2026-100548OpenClaw before 2026.8.1 Credential Exposure via Embedding Fallback
Medium 5.3
In plain English
A medium-severity information exposure in OpenClaw from OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 contain a credential exposure issue in memory embedding failover. When remote embedding fallback is configured and the primary embedding provider fails, the request can be sent to a different fallback provider while still reusing the primary provider's configured API key, causing that credential to be transmitted as a bearer token to an unintended vendor. The practical impact depends on the configured providers, whether failover occurs, and the privileges attached to the primary provider key. The issue is fixed in 2026.8.1; as a workaround, disable cross-provider embedding fallback or configure each provider with separate, narrowly scoped credentials.
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- GitHub Security Advisory (GHSA-66hm-hxq3-5pfh) vendor-advisory
- VulnCheck Advisory: OpenClaw before 2026.8.1 Credential Exposure via Embedding Fallback third-party-advisory