CVE-2026-100548 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 contain a credential exposure issue in memory embedding failover. When remote embedding fallback is configured and the primary embedding provider fails, the request can be sent to a different fallback provider while still reusing the primary provider's configured API key, causing that credential to be transmitted as a bearer token to an unintended vendor. The practical impact depends on the configured providers, whether failover occurs, and the privileges attached to the primary provider key. The issue is fixed in 2026.8.1; as a workaround, disable cross-provider embedding fallback or configure each provider with separate, narrowly scoped credentials.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in OpenClaw versions greater than or equal to 2026.3.28 and less than 2026.8.1 represents a critical credential exposure flaw rooted in the application's memory embedding failover mechanism. This issue specifically manifests when the software is configured with remote embedding fallback options, allowing for redundancy in case of service unavailability from the primary provider. Under normal operational conditions, requests are routed to the designated primary embedding provider using its associated API key as a bearer token. However, during a failure event where the primary provider becomes unreachable or returns an error requiring failover, the application incorrectly retains and reuses the primary provider's configured API key when routing the request to a secondary fallback provider. This architectural oversight results in the transmission of sensitive credentials intended for one vendor being sent to an entirely different, unintended third-party service.
From a technical perspective, this flaw constitutes a severe breach of credential isolation principles. The application logic fails to validate or swap authentication tokens based on the target endpoint during the failover process. Instead, it blindly applies the initially configured authorization header regardless of which provider ultimately processes the request. This behavior aligns with CWE-798: Use of Hard-coded Credentials and CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, as it leads to the accidental disclosure of secrets outside their intended trust boundary. The severity of this vulnerability is heavily dependent on the privileges attached to the primary provider's API key. If that key possesses broad permissions or access to sensitive data repositories, its exposure to a third-party vendor could lead to unauthorized data access, manipulation, or exfiltration by entities that should not have any visibility into those resources.
The operational impact of this vulnerability is significant and potentially catastrophic depending on the security posture of the organization deploying OpenClaw. An attacker who can induce a failure in the primary embedding provider, such as through a denial-of-service attack or by exploiting network instability, could trigger the failover mechanism. While the immediate act may not be maliciously initiated by an external adversary, the resulting credential leakage creates a persistent risk if the fallback provider is compromised or acts with malicious intent. Furthermore, this vulnerability facilitates lateral movement in scenarios where multiple embedding services are used for different data classifications. The unintended vendor receiving the primary key could potentially use it to access other systems linked to that identity, thereby expanding the attack surface beyond the immediate scope of the embedding service. This scenario also touches upon ATT&CK technique T1539: Potential Data Exfiltration over Web Service, as sensitive credentials are exfiltrated via standard web protocols to an unauthorized destination.
Mitigation strategies must address both the immediate risk and the underlying architectural weakness. The primary remediation is to upgrade OpenClaw to version 2026.8.1 or later, where this failover logic has been corrected to ensure that each provider uses its own distinct credentials. For organizations unable to patch immediately due to dependency constraints, a robust workaround involves disabling cross-provider embedding fallback entirely if redundancy is not strictly required for the specific use case. Alternatively, administrators should configure each available embedding provider with separate, narrowly scoped API keys. By ensuring that the primary key has minimal privileges and does not grant access to critical data stores, the blast radius of any potential credential leakage is significantly reduced. Regular rotation of these credentials further limits the window of opportunity for exploitation. Continuous monitoring of network traffic for anomalous authentication attempts against fallback providers can also aid in early detection of this issue if it were ever exploited in a live environment.