CVE-2026-100590 OpenClaw before 2026.7.1 Authorization Bypass via voice set
Attackers can modify voice configuration settings via the voice set command without proper authorization, compromising configuration integrity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-100590?
CVE-2026-100590 is a medium-severity missing authorization vulnerability in OpenClaw, published on 26 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenClaw before 2026.7.1 contains an authorization bypass vulnerability in the /voice set command that allows non-owner external-channel senders to persist Gateway voice configuration. Attackers with command access can change the voice used by Talk responses for the configured provider, affecting configuration integrity without exposing credentials or granting additional host capabilities.
Weakness: CWE-863
Which versions are affected by CVE-2026-100590?
How do I fix CVE-2026-100590?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-100590 being exploited?
There is no known exploitation of CVE-2026-100590 in the wild and no public exploit code.
Sources
Also known as GHSA-5j27-v2pw-cj9m, GHSA-mh98-4wwc-cp33, MINI-hh52-8393-cm2c.