CVE-2026-100589 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the browser tool that allows sandboxed sessions to access paired node browser actions despite allowHostControl=false configuration. Attackers with control over sandboxed agent input can select a paired node and perform host browser operations, inspecting or manipulating the connected browser profile and its authenticated state.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.