Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100593OpenClaw before 2026.7.1 Authentication Bypass via activation

Medium 5.4

In plain English

A medium-severity missing authorization in OpenClaw from OpenClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.1%top 96.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenClaw (npm package `openclaw`) before 2026.7.1 does not enforce the documented owner-only requirement for persistent `/activation` policy changes in group channels. An authorized non-owner channel sender can change whether the agent requires mention-based activation, causing the agent to respond more broadly in the group (exposing its responses to additional group traffic) or suppressing expected activation behavior until an owner restores the intended setting. The issue is fixed in version 2026.7.1.

Affected products (as reported)

Vendor	Product	Versions
OpenClaw	OpenClaw	0 – before 2026.7.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-q9j5-4xr6-xqqw) vendor-advisory
VulnCheck Advisory: OpenClaw before 2026.7.1 Authentication Bypass via activation third-party-advisory