CVE-2026-100527 OpenClaw before 2026.8.2 Denial of Service via Browser Relay
Unauthenticated attackers can exhaust pending authentication slots in the Browser Relay, preventing legitimate extensions from connecting and causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-100527?
CVE-2026-100527 is a medium-severity denial of service vulnerability in OpenClaw, published on 26 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthenticated network sources to exhaust pending-authentication capacity. Attackers can hold every pending slot by maintaining silent WebSocket upgrades, preventing paired extensions from completing Browser Relay Authentication v2.
Weakness: CWE-400
Which versions are affected by CVE-2026-100527?
How do I fix CVE-2026-100527?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-100527 being exploited?
There is no known exploitation of CVE-2026-100527 in the wild and no public exploit code.
Sources
Also known as GHSA-2rm8-9g74-xwqp, GHSA-m78m-7h3q-q938, MINI-gvjw-46rc-h3x5.