CVE-2026-100529 OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer
Attackers can bypass file-transfer authorization scopes in OpenClaw to access unauthorized paths or nodes via glob metacharacter exploitation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-100529?
CVE-2026-100529 is a high-severity missing authorization vulnerability in OpenClaw, published on 26 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access sibling paths or different nodes beyond the operator's original approval scope.
Weakness: CWE-863
Which versions are affected by CVE-2026-100529?
How do I fix CVE-2026-100529?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-100529 being exploited?
There is no known exploitation of CVE-2026-100529 in the wild and no public exploit code.
Sources
Also known as GHSA-4gx2-8r4q-vj5x, GHSA-7jfq-rmfm-29wp, MINI-3v39-m6xh-99cj.