CVE-2026-100578 OpenClaw before 2026.7.1 Authorization Bypass via chat.send
Non-owner users can invoke owner-only tools via chat.send in specific authentication modes, allowing unauthorized configuration changes and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-100578?
CVE-2026-100578 is a high-severity missing authorization vulnerability in OpenClaw, published on 26 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenClaw (npm package `openclaw`) before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, a write-scoped non-owner caller can start a chat turn whose tool inventory includes the `gateway` and `cron` tools, causing the agent to invoke owner-only configuration or scheduling operations, including persistent state changes. Practical impact depends on the tools selected by the model and the caller's ability to steer the turn. Shared-secret token and password callers are treated as fully trusted operators under OpenClaw's security model and are outside the scope of this issue. The issue is fixed in 2026.7.1; as a workaround, restrict chat.send to administrators in identity-bearing deployments and remove `gateway` and `cron` from affected agent tool policies.
Weakness: CWE-269
Which versions are affected by CVE-2026-100578?
How do I fix CVE-2026-100578?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-100578 being exploited?
There is no known exploitation of CVE-2026-100578 in the wild and no public exploit code.
Sources
Also known as GHSA-9cj9-w25j-5478, GHSA-qw7m-h363-33qw, MINI-c7c4-c6c6-c86h.