CVE-2026-100529 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access sibling paths or different nodes beyond the operator's original approval scope.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/26/2026
The identified vulnerability in OpenClaw versions prior to 2026.8.1 represents a critical authorization bypass mechanism rooted in improper handling of file-transfer permissions, specifically within the allow-always approval workflow. This flaw allows attackers to escalate privileges by reusing standing grants that were originally intended for specific, reviewed paths or nodes. The core technical issue lies in how the system interprets glob metacharacters and handles node display names during authorization checks. When an operator approves a file transfer request, they typically define a scope limited to certain directories or files. However, due to insufficient validation of these scopes against actual filesystem structures, attackers can manipulate input parameters to exploit ambiguities in path resolution. By leveraging wildcard characters such as asterisks and question marks within the requested paths, adversaries can broaden the effective range of access beyond what was explicitly approved by the operator.
This vulnerability is fundamentally classified under CWE-269 Improper Privilege Management, specifically relating to authorization scope widening where a user or process retains permissions that exceed their intended role. Furthermore, it aligns with ATT&CK technique T1078 Valid Accounts, as attackers utilize legitimate credentials and approved workflows to gain unauthorized access. The exploitation relies on the system's failure to strictly enforce boundary conditions between different nodes in a distributed environment. If two distinct nodes share similar or identical display names but reside in separate security domains, an attacker can craft requests that appear valid under one node’s context while actually accessing resources on another. This cross-node confusion enables lateral movement and access to sensitive data stored on sibling paths that were not part of the original approval scope.
The operational impact of this vulnerability is severe, as it undermines the principle of least privilege central to secure system design. Attackers can exfiltrate confidential files from directories they should not have access to, potentially leading to significant data breaches and compliance violations. In enterprise environments where OpenClaw manages large-scale file transfers across multiple servers or cloud storage accounts, this flaw could allow an insider threat or a compromised account to harvest sensitive information without triggering immediate alerts based on standard permission checks. The ability to reuse standing grants means that even if individual requests are logged and reviewed, the underlying authorization logic remains flawed, allowing persistent access through seemingly legitimate actions.
Mitigation strategies must focus on strict input validation and enhanced scope enforcement mechanisms. Developers should implement rigorous parsing of glob patterns to ensure they do not resolve to unintended paths or nodes outside the approved boundary. It is essential to decouple node display names from actual unique identifiers used in authorization checks, ensuring that each request is validated against a canonical path rather than a potentially ambiguous name. Additionally, implementing dynamic scope verification at runtime can prevent the reuse of standing grants for unreviewed resources. Organizations running affected versions should immediately upgrade to version 2026.8.1 or later, where these issues have been addressed through stricter validation logic and improved separation of node contexts in the authorization engine.