CVE-2026-100534 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel ACP or subagent work outside the route's configured authority.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
OpenClaw versions prior to 2026.8.1 are affected by a critical authorization bypass vulnerability within its webhook TaskFlow cancellation mechanism, specifically identified as CWE-287 Improper Authentication and CWE-923 Improper Restriction of Excessive Authority. This flaw arises from insufficient validation of session identifiers during the termination process for autonomous code execution or subagent tasks. The system relies on a webhook route secret to authenticate incoming requests but fails to enforce strict ownership constraints when processing cancellation commands, allowing an authenticated actor to manipulate state outside their designated scope.
The technical core of this vulnerability lies in how the application handles child session keys associated with TaskFlow operations. When a request is received to cancel a specific task or subagent execution, the system verifies that the requester possesses a valid webhook route secret but does not subsequently verify that the specified child session key belongs exclusively to tasks initiated by that particular route's authorized context. Consequently, an attacker who has obtained access to any single webhook route secret can construct malicious requests containing arbitrary identifiers for other active sessions running under different routes or administrative contexts. This lack of cross-route isolation permits the unauthorized termination of unrelated computational processes.
The operational impact of this vulnerability is significant in environments where OpenClaw manages multiple concurrent workflows with varying levels of sensitivity and authority. By canceling ACP (Autonomous Code Processing) tasks or subagent work outside their configured authority, an attacker can disrupt critical business logic, cause denial of service for legitimate users, or interfere with ongoing data processing pipelines that rely on uninterrupted execution. In scenarios where these sessions involve sensitive data handling or financial transactions, the premature termination could lead to data inconsistency, incomplete state updates, or loss of transactional integrity. Furthermore, this capability undermines the fundamental security principle of least privilege by allowing a low-privileged webhook consumer to exert control over high-privilege system operations.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK technique T1530 Data from Information Repositories if used in conjunction with other exploits to gather context before disruption, but more directly maps to T1499 Endpoint Denial of Service through the deliberate cancellation of active processes. It also reflects aspects of T1078 Valid Accounts as it requires initial authentication via a compromised or leaked webhook secret. The ability to target arbitrary sessions suggests that once an attacker gains foothold in one part of the system, they can cause widespread disruption across other isolated components, effectively breaking down logical boundaries intended by the application architecture.
Mitigation strategies must prioritize immediate patching to version 2026.8.1 or later, where this authorization logic has been corrected to enforce strict ownership checks on session keys before processing cancellation requests. In addition to upgrading, organizations should implement robust secret management practices to prevent webhook route secrets from being exposed in logs, repositories, or client-side code. Network-level controls such as IP whitelisting for webhook endpoints can reduce the attack surface by limiting which sources are permitted to send cancellation commands. Furthermore, implementing audit logging that records not only who initiated a task but also validates and logs ownership checks during lifecycle events like cancellation will aid in detecting any attempted exploitation of this flaw before it causes significant damage. Regular security assessments focusing on API authorization logic are recommended to identify similar gaps in other endpoints within the OpenClaw ecosystem.