CVE-2026-100591 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable Active Memory for the Gateway, disabling memory recall for future sessions or re-enabling global recall where the owner expected it to remain disabled. The issue is limited to persistent global on/off mutations; session-level controls and read-only status remain governed by existing command policy. The issue is fixed in version 2026.7.1. (Suggested title: "OpenClaw before 2026.7.1 missing owner authorization check on Active Memory global toggles".)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in OpenClaw, specifically within versions prior to the release of 2026.7.1, represents a critical failure in access control mechanisms governing persistent configuration changes for the agent gateway's memory subsystem. As an npm-distributed agent gateway, OpenClaw relies on strict authorization policies to ensure that only designated owners or administrators can modify core operational parameters. The specific flaw resides in the handling of global Active Memory toggle mutations, where the system fails to verify whether the requesting entity holds ownership privileges over the affected configuration scope. This omission allows an authorized user who interacts with external channels but lacks owner status to execute state-changing commands that should be restricted exclusively to owners.
From a technical perspective, this defect constitutes a classic Broken Access Control vulnerability, aligning closely with CWE-269: Improper Privilege Management and CWE-862: Missing Authorization. The attacker leverages the external-channel interface to send mutation requests for enabling or disabling Active Memory globally. Because the backend logic does not cross-reference these requests against an owner verification table or permission matrix before applying the change, the system accepts and persists the modification regardless of the sender's actual role. This bypasses the intended security boundary that separates administrative configuration tasks from standard operational interactions facilitated by non-owner users.
The operational impact of this vulnerability is significant due to its persistent nature. Unlike transient session-level controls which remain protected by existing command policies, global toggles affect the long-term behavior of the gateway. An unauthorized actor can permanently disable memory recall for future sessions, effectively causing a denial of service for any functionality that depends on historical context or state retention. Conversely, they may also re-enable global recall in environments where the owner has intentionally disabled it to preserve privacy or reduce computational overhead. This lack of integrity control means that security-conscious configurations intended by the administrator can be silently overridden, potentially exposing sensitive conversational data or altering system behavior in ways that violate organizational policy.
This incident maps directly to several techniques within the MITRE ATT&CK framework for enterprise environments. The exploitation vector corresponds to T1078: Valid Accounts, as the attacker uses legitimate credentials but abuses their permissions through a logic flaw rather than credential theft. Furthermore, the persistence of the configuration change aligns with T1531: Account Access Removal or T1496: Resource Hijacking depending on whether memory is disabled to degrade service or enabled to exfiltrate context. The vulnerability highlights a gap in how state mutations are validated against user roles, emphasizing that authentication alone is insufficient without robust authorization checks for administrative actions.
To mitigate this risk and prevent similar issues in future releases, developers must implement strict role-based access control (RBAC) validation on all configuration mutation endpoints. Specifically, any API or command handler responsible for altering global Active Memory settings must verify the requesting user's ownership status before processing the request. Input validation should be complemented by explicit authorization checks that reject requests from non-owner accounts with a clear error message indicating insufficient privileges. Additionally, implementing audit logging for such high-impact configuration changes can aid in detecting unauthorized attempts and provide forensic evidence if an incident occurs. Organizations running affected versions of OpenClaw are strongly advised to upgrade immediately to version 2026.7.1 or later, where this owner check has been properly enforced to restore the integrity of access controls.