rootpwn

low · CVSS v3 3.1 · CVSS v4 2.3 · EPSS 0.00266

CVE-2026-100534

OpenClaw versions prior to 2026.8.1 have an authorization bypass in webhook TaskFlow cancellation. An attacker with a webhook route secret c

Overview

OpenClaw versions prior to 2026.8.1 have an authorization bypass in webhook TaskFlow cancellation. An attacker with a webhook route secret can cancel unrelated sessions, potentially disrupting ACP or subagent operations. This flaw can affect any deployment using the vulnerable OpenClaw webhook functionality.

Description

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel ACP or subagent work outside the route's configured authority.

Impact

Confidentiality impact is minimal; Integrity is compromised by unauthorized session cancellation; Availability may be affected by denial of critical tasks. Defenders such as system administrators and DevOps teams managing OpenClaw deployments are impacted.

Remediation

Apply the 2026.8.1 patch or later. If patch cannot be applied immediately, restrict webhook route secrets to only authorized users, enforce least privilege, and monitor for unexpected cancellation events. Additionally, disable or isolate the TaskFlow cancellation endpoint until a fix is deployed.

Risk context

The vulnerability has a low severity score (CVSS v3 3.1) and a very low EPSS of 0.00266, indicating a low likelihood of exploitation in the wild. Nevertheless, defenders should address it promptly to prevent potential disruption.

Affected products

  • OpenClaw

Scores

Severity
low
CVSS v2
2.1
CVSS v3
3.1
CVSS v4
2.3
EPSS
0.00266

authorization-bypass webhook session-cancellation OpenClaw low-severity defense patch

← All CVEs

Related CVEs

low

CVE-2026-100537

OpenClaw (npm package 'openclaw') before 2026.8.1 fails to apply the originating requester's effective tool policy during Active Memory automatic recall. In deployments that use Active Memory together with requester-specific tool rules, deterministic and hidden recall paths can retrieve durable memory and inject it into the agent's context even when toolsBySender explicitly denies that requester access to the memory tools (memory_search, memory_get). As a result, an admitted but denied sender can receive information derived from durable memory in the agent's response without directly invoking any memory tool. The issue is fixed in 2026.8.1.

View analysis

low

CVE-2026-100539

OpenClaw (npm package 'openclaw') before 2026.8.1 fails to revoke memory tool access when an operator hot-disables memory configuration. Existing memory_search and memory_get tool instances retain the enabled configuration captured at creation time because the execution-time resolver treats explicit disablement like an unavailable configuration snapshot and restores the stale authority. As a result, during an already-running agent turn the model can continue searching and reading durable memory after the operator revoked that access, for the remainder of that run. Exploitation requires memory to be disabled while a previously created memory tool remains active. The issue is fixed in 2026.8.1.

View analysis

low

CVE-2026-100542

OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and < 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained listings so that entry-count and size checks pass, and the archive is then extracted in full. If an operator approves installation of such a malicious or compromised skill archive, over-limit files or entry counts are persisted in the skill tools directory, consuming disk space or inodes. The issue bypasses OpenClaw's extraction budgets but does not by itself execute archive contents. Fixed in 2026.8.1.

View analysis

low

CVE-2026-84742

The Events Calendar WordPress plugin before 6.17.5 has a missing capability check in its REST API. This can allow users with limited roles, such as contributor, to create or update content and bypass normal editorial review. It matters because it can undermine content governance on WordPress sites using the plugin.

View analysis