CVE-2026-100535 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating requester's restrictions and untrusted provenance when session-derived text is persisted to session memory. In deployments where session-memory capture and dreaming are enabled, a restricted external sender whose messages are admitted with limited tools can persist instructions that are later supplied to an unattended background (dreaming) agent holding broader file and command capabilities, allowing actions beyond the authority of the original turn and affecting files, commands, or services available to that agent. Exploitation requires the content to be captured, selected for later processing, and followed by the model. The issue is fixed in 2026.8.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in OpenClaw versions greater than or equal to 2026.4.5 and less than 2026.8.1 represents a critical failure in access control enforcement within the session management architecture of the application. This flaw specifically impacts deployments where both session-memory capture and dreaming features are enabled, creating an environment where context from restricted user sessions can leak into privileged operational contexts. The core technical issue lies in how text derived from active sessions is persisted to memory without adequate sanitization or restriction propagation mechanisms. When a message is received from an external sender who has been granted limited permissions and access to specific tools, the system fails to maintain the provenance of that request's originator restrictions during the persistence phase. Consequently, the contextual data associated with this restricted interaction loses its boundary constraints, effectively stripping away the limitations imposed on the original requester.
This architectural flaw enables a sophisticated privilege escalation scenario through what can be described as context poisoning or instruction injection via memory state. In these specific deployments, the system captures session text and stores it for later processing by background agents known as dreaming agents. These unattended background processes typically operate with broader capabilities than standard interactive sessions, including elevated permissions to execute commands, modify files, or interact with sensitive services. Because the persisted session-derived text retains no indication of its restricted origin, when this content is subsequently supplied to a dreaming agent for processing, the agent interprets the instructions as if they originated from an authorized source with full privileges. This allows an attacker who initially had only limited access to issue commands that are executed by the high-privilege background process, thereby bypassing the intended security boundaries and affecting files, executing arbitrary commands, or manipulating services available exclusively to the dreaming agent.
The exploitation of this vulnerability requires a multi-step sequence involving content capture, selection for later processing, and execution by the model. An attacker must first gain access as an external sender with restricted permissions but sufficient ability to submit messages that are admitted into the session memory. Once these messages containing malicious instructions or crafted prompts are persisted, they await activation when the dreaming agent processes them in the background. The success of this attack relies on the timing and selection mechanisms within OpenClaw's architecture, which must prioritize or include the poisoned context during the agent's operational cycle. This creates a significant risk where low-privilege users can indirectly influence high-impact system actions without direct authorization, leading to potential data exfiltration, unauthorized configuration changes, or complete compromise of the underlying infrastructure depending on the scope of permissions held by the dreaming agents.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, as it involves the failure to enforce proper access controls for an actor against a resource. Furthermore, the technique of using user input to influence system behavior in unintended ways through context manipulation is consistent with ATT&CK techniques related to Command and Scripting Interpreter abuse or potentially T1059 Command Line Interface if command execution is achieved via text prompts. The persistence mechanism described also bears similarities to CWE-798 Use of Hard-coded Credentials if the session memory acts as a persistent store for malicious state, although it is more accurately categorized under injection flaws due to the semantic interpretation of the stored data by an AI agent rather than direct code execution in traditional software terms.
To mitigate this vulnerability, organizations running OpenClaw versions within the affected range must immediately upgrade to version 2026.8.1 or later, where these issues have been resolved. In environments where upgrading is not immediately feasible, administrators should consider disabling session-memory capture and dreaming features if they are not strictly required for business operations, thereby removing the attack vector entirely. Additionally, implementing strict input validation and output encoding on all data persisted to session memory can help reduce the risk of instruction injection, although this may not fully address the semantic interpretation flaws inherent in AI-driven agents. Security teams should also audit existing deployments for any evidence of unauthorized background activity or unexpected file modifications that might indicate successful exploitation of this flaw before remediation is completed.