CVE-2026-100587 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can install arbitrary plugins and execute MCP processes with OpenClaw user privileges, affecting host confidentiality, integrity, and availability.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.