CVE-2026-100528 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw (npm package 'openclaw') before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base URL, a pinned session that continues after a model configuration hot reload retains that provider's credential while the OpenAI SDK selects its own default endpoint. A resulting request could disclose the configured third-party provider credential to an unrelated provider endpoint and fail with a misleading authentication error. Operators who observed this condition should rotate the affected credential. The issue is fixed in 2026.8.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified within OpenClaw versions prior to release 2026.8.1 represents a critical configuration handling flaw that leads to the accidental exfiltration of sensitive authentication credentials. This defect specifically impacts scenarios where the application integrates with third-party AI providers utilizing an API structure compatible with OpenAI standards. The root cause lies in how the software manages session persistence and endpoint resolution during dynamic model reconfiguration events, such as hot reloads. When a user configures a provider that relies on this compatibility layer but does not explicitly define a concrete base URL within the resolved model metadata, the system fails to maintain the correct contextual binding between the active credentials and their intended destination service.
From a technical perspective, the flaw manifests when an existing session remains pinned after a configuration change occurs. In normal operation, the OpenAI SDK is designed to select default endpoints based on current settings. However, due to this implementation error, the SDK retains the authentication token associated with the previously configured third-party provider while simultaneously routing the request through its own internal logic for endpoint selection. This mismatch results in the transmission of credentials intended for a specific external vendor being sent instead to an unrelated or generic OpenAI-compatible endpoint controlled by the underlying library rather than the target service. Consequently, sensitive API keys are exposed to entities that do not have authorization to use them, creating a significant data leakage risk.
The operational impact of this vulnerability is twofold: immediate credential compromise and subsequent authentication failures for legitimate operations. The disclosure of third-party provider credentials allows potential attackers or unintended services to access resources belonging to the affected organization's partners. This violates the principle of least privilege and compromises the confidentiality guarantees expected in secure API integrations. Furthermore, because the request reaches an endpoint that does not recognize the specific format or scope of the leaked credential, it typically results in a misleading authentication error for the legitimate user. This can lead to confusion during troubleshooting, as the system appears to be experiencing connectivity issues rather than revealing the underlying security breach where credentials were misrouted and potentially intercepted by unauthorized parties.
This issue aligns with CWE-209, which describes the generation of an error message that includes sensitive information about the software environment or internal state, although in this case, the primary concern is broader credential exposure (CWE-798: Use of Hard-coded Credentials) combined with improper access control mechanisms. In terms of adversary behavior as mapped by MITRE ATT&CK, this vulnerability facilitates Credential Access techniques where attackers might intercept these misrouted requests to harvest API keys for lateral movement or unauthorized resource consumption within the AI provider ecosystem. The lack of explicit endpoint binding during session persistence creates an opportunity for credential stuffing or abuse if those leaked tokens are not promptly revoked.
To mitigate this risk and prevent further exposure, operators must immediately rotate all affected third-party provider credentials that were active in instances running vulnerable versions of OpenClaw. Rotating these keys invalidates any potentially intercepted tokens obtained through the misrouted requests described above. Additionally, organizations should upgrade to version 2026.8.1 or later, where this logic error has been corrected to ensure that session contexts are properly isolated during configuration changes and that endpoint resolution strictly adheres to explicitly defined base URLs rather than falling back to ambiguous defaults when metadata is incomplete. Regular auditing of API key usage patterns can also help detect any unauthorized access resulting from the window of exposure prior to remediation.