CVE-2026-100590 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw before 2026.7.1 contains an authorization bypass vulnerability in the /voice set command that allows non-owner external-channel senders to persist Gateway voice configuration. Attackers with command access can change the voice used by Talk responses for the configured provider, affecting configuration integrity without exposing credentials or granting additional host capabilities.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/26/2026
The identified security flaw resides within OpenClaw versions prior to 2026.7.1 and specifically targets the /voice set command interface. This vulnerability constitutes a critical authorization bypass that undermines the intended access control model of the application. The core technical issue is rooted in insufficient validation of user privileges when processing voice configuration requests for external channels. Specifically, the system fails to verify whether the entity initiating the change holds owner-level permissions or administrative rights over the specific channel context. Instead, it accepts and persists configuration changes from any authenticated sender who possesses basic command execution capabilities within that external channel environment. This design oversight allows non-owner users to modify critical operational parameters without proper authorization checks, effectively bypassing the security boundaries established by the application developers.
From a technical perspective, this vulnerability falls under the category of broken access control, which is consistently ranked as one of the most significant risks in modern software development according to industry standards such as CWE-269: Improper Privilege Management and CWE-862: Missing Authorization. The flaw enables an attacker with minimal initial privileges to alter system behavior by changing the voice provider used for text-to-speech responses generated by the Gateway. This action does not involve credential theft or direct host compromise, but rather represents a manipulation of application state that affects configuration integrity. By persisting these unauthorized changes, the vulnerability allows persistent modification of how the bot interacts with users in external channels, potentially leading to inconsistent user experiences or unintended behavioral shifts depending on the selected voice provider settings.
The operational impact of this vulnerability is primarily centered around the degradation of service reliability and trust within multi-user environments where role-based access control is expected. While an attacker cannot escalate privileges to gain administrative rights over the host system or exfiltrate sensitive data directly, they can disrupt normal operations by forcing specific voice configurations that may incur unexpected costs if premium providers are selected, or degrade user experience through inappropriate audio outputs. In enterprise settings, this lack of integrity in configuration management could lead to compliance issues if audit trails do not accurately reflect who made the changes, as the system attributes the action to any command sender rather than validating their authority level. This undermines the principle of least privilege and complicates forensic analysis during incident response scenarios where distinguishing between authorized administrative actions and malicious modifications is crucial for maintaining security posture.
To mitigate this risk, immediate patching to version 2026.7.1 or later is strongly recommended as it addresses the underlying authorization logic in the /voice set command handler. In environments where upgrading is not immediately feasible, administrators should implement strict input validation and role-based access control checks at the application layer before processing any configuration change requests. It is also advisable to review audit logs for unauthorized modifications to voice settings and restrict command execution permissions on external channels to only those users with verified owner or administrator roles. Additionally, integrating this fix into a broader security strategy that includes regular penetration testing focused on authorization bypasses will help identify similar weaknesses in other parts of the OpenClaw ecosystem before they can be exploited by malicious actors seeking to manipulate system behavior without detection.