rootpwn

critical · CVSS v3 8 · CVSS v4 8.6 · EPSS 0.00193

CVE-2026-100585

OpenClaw npm package openclaw before 2026.7.1 fails to enforce owner-only authorization for Claude Code permission prompts via the MCP chann

Overview

OpenClaw npm package openclaw before 2026.7.1 fails to enforce owner-only authorization for Claude Code permission prompts via the MCP channel bridge. An authorized non‑owner channel sender can approve or deny pending requests, allowing actions to proceed without owner consent. This flaw could enable unauthorized code execution or data access.

Description

OpenClaw (npm package `openclaw`) before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel command access can approve or deny a pending permission request intended for the owner, causing the requested action to proceed without owner consent. The practical impact depends on the pending action and the host capabilities requested by the Claude Code run. The issue is fixed in version 2026.7.1.

Impact

Confidentiality, integrity, and availability can be compromised for users of OpenClaw when non‑owner channel senders manipulate permission prompts. Defenders should monitor for unauthorized permission approvals and restrict channel command access to owners only.

Remediation

Upgrade to version 2026.7.1 or later. If upgrade is not possible, restrict channel command access to owners, disable the MCP channel bridge, or enforce a manual approval workflow for permission requests.

Risk context

Critical severity with an EPSS of 0.00193 indicates a rare but high‑impact vulnerability. Defenders should prioritize patching or mitigation promptly.

Affected products

  • OpenClaw
  • openclaw npm package

Scores

Severity
critical
CVSS v2
9
CVSS v3
8
CVSS v4
8.6
EPSS
0.00193

npm OpenClaw authorization MCP critical patch defense

← All CVEs

Related CVEs

critical

CVE-2026-100671

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists get_cookie(), which returns any cookie sent with the current request, including the visitor's session cookie. Because the read occurs server-side via filter_input(INPUT_COOKIE, ...), the HttpOnly, Secure and SameSite attributes offer no protection. Grav then stores the finished post-Twig output in a page-content cache keyed only on page identity and the configuration checksum, with no session, user or request dimension and no bypass for authenticated visitors. A page published by a page-write user can therefore capture the session identifier of the next administrator who views it, after which the cached output serves that identifier to unauthenticated visitors, who can replay the cookie to authenticate as that administrator. Since 2.0.19, security.twig_content.process_enabled defaults to true and Security::applyTwigContentDefault() derives each page's process.twig flag from that gate, so content Twig runs on every page with no frontmatter or operator action. Fixed in 2.0.25; 1.7.x is outside the backport scope.

View analysis

critical

CVE-2026-100520

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.

View analysis

critical

CVE-2026-100544

CVE-2026-100544 exposes the openclaw/voice-call package to remote callers who can trigger owner‑only tools without identity verification. The flaw allows attackers to read, modify, or execute commands on the agent. It is fixed in version 2026.8.1.

View analysis

critical

CVE-2026-100551

OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had accepted a Gateway fingerprint, an attacker able to redirect the same host and port and present a different certificate that is accepted by iOS system trust can serve a replacement Control UI page; opening the Terminal or a session Dashboard then allows that page to read the injected Gateway token or password. The stolen credential can grant operator access, including reading sensitive Gateway state and invoking host-capable tools. This issue is fixed in 2026.8.11.

View analysis