OpenClaw: 25 Authorization Bypass and Access Control Vulnerabilities Disclosed Together
Key findings • 25 CVEs disclosed for OpenClaw on September 26, 2026, with many rated High severity. • Multiple vulnerabilities involve authorization bypass, allowing non-owners to access owne…
Key findings
- 25 CVEs disclosed for OpenClaw on September 26, 2026, with many rated High severity.
- Multiple vulnerabilities involve authorization bypass, allowing non-owners to access owner-only data and execute privileged commands.
- Browser integrations and command execution are key areas affected, with sandbox bypasses and arbitrary command execution risks.
- Patches are available in OpenClaw versions 2026.7.1 and later, with specific fixes for integrations in 2026.8.x releases.
- The batch highlights systemic issues in access control and permission validation within the OpenClaw architecture.
On September 26, 2026, a significant batch of 25 vulnerabilities was disclosed for OpenClaw, an agent gateway distributed via npm. These vulnerabilities, all disclosed on the same day, span a range of severity levels, with many classified as High, posing substantial risks to confidentiality, integrity, and availability. The disclosures highlight a pervasive theme of authorization bypass and improper access control across various OpenClaw components and integrations.
Several vulnerabilities stem from OpenClaw's handling of user permissions and scopes. CVE-2026-100596 and CVE-2026-100587 detail how non-owner users can execute privileged MCP configuration changes and install arbitrary plugins, respectively, by bypassing authorization checks in commands like /mcp set, /mcp unset, and the Codex computer-use installation command. Similarly, CVE-2026-100595 and CVE-2026-100594 reveal authorization bypasses in diagnostics export and trajectory export commands, allowing unauthorized senders to access sensitive owner-only data.
The browser integration of OpenClaw is also affected by multiple high-severity flaws. CVE-2026-100589 describes a sandbox bypass in the browser tool, enabling sandboxed sessions to perform host browser operations even with allowHostControl=false. CVE-2026-100588 further exacerbates this by not enforcing administrator scope on browser control when accessed via node.invoke, despite direct access requiring it.
Command execution and input handling present another cluster of vulnerabilities. CVE-2026-100599 details how the googlemeet.chrome command bypasses the exec approval path, allowing for the execution of arbitrary commands on paired nodes. CVE-2026-100580 highlights a case sensitivity issue in the model-facing cron tool, which can be exploited to create persistent cron jobs by normalizing mixed-case payloads. Furthermore, CVE-2026-100597 points to a time-of-check time-of-use race condition in filesystem mutation operations, where operations like remove, mkdir, and rename could act on different targets after a path-safety check.
Integrations with various platforms and services are also impacted. CVE-2026-100575 describes a failure to enforce sender allowlists in OpenClaw Slack's multi-person direct messages, allowing disallowed participants to trigger agents. CVE-2026-100583 reveals an authorization bypass in OpenClaw Discord's guild metadata read actions, enabling lower-trust senders to access restricted information. Additionally, CVE-2026-100584 notes a PowerShell command analysis flaw on Windows that could lead to the execution of unintended executables.
Several medium-severity vulnerabilities focus on persistent state and configuration management. CVE-2026-100592 and CVE-2026-100591 address omissions in owner permission checks for persistent memory dreaming and Active Memory toggles, allowing non-owners to alter these settings. CVE-2026-100593 notes that /activation policy changes in group channels do not enforce owner-only requirements, leading to broader agent responses. CVE-2026-100590 details an authorization bypass in the /voice set command, permitting non-owners to persist Gateway voice configurations.
Other notable vulnerabilities include CVE-2026-100598, which describes an issue where Signal approval reactions could incorrectly bind to ordinary text messages. CVE-2026-100579 involves trusting requester provenance in message.action, allowing write-scoped callers to impersonate other senders. CVE-2026-100578 points to a failure to restrict owner-only infrastructure tools exposed through chat.send. CVE-2026-100577 and CVE-2026-100576 highlight vulnerabilities in video asset URL validation and browser wait predicates, respectively, potentially leading to server-side requests to private destinations.
The majority of these vulnerabilities were fixed in OpenClaw version 2026.7.1, with some specific channel plugins and platform integrations receiving patches in versions 2026.8.1 or 2026.8.11. Users are strongly advised to update to the latest available versions to mitigate these risks. The sheer volume and the nature of these authorization bypasses underscore the critical need for rigorous access control and permission validation in agent gateway systems like OpenClaw.
This extensive disclosure event serves as a stark reminder for OpenClaw users to promptly apply security updates. The common theme of authorization flaws across numerous components suggests a need for a comprehensive review of permission models within the OpenClaw architecture. Future attention should focus on ensuring that all privileged operations and data access are strictly confined to authorized users and roles, especially in multi-tenant or shared environments. The timely patching by the OpenClaw team is commendable, but the breadth of the issues necessitates ongoing vigilance from the user community.