CVE-2026-100592 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw is an agent gateway distributed via npm. In versions >= 2026.4.10 and < 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent '/dreaming on' and '/dreaming off' commands to enable or disable the Gateway's Memory Core dreaming behavior, disabling background memory processing or re-enabling durable memory promotion where the owner expected it to remain disabled; the practical confidentiality, integrity, and availability impact depends on stored conversation material and subsequent memory use. Read-only status and help commands remain governed by normal command policy. The issue is fixed in version 2026.7.1. As a workaround, disable dreaming commands in external channels or restrict channel command access to owners.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
OpenClaw functions as an agent gateway distributed via the npm package ecosystem, facilitating communication and memory management for AI agents. In versions ranging from 2026.4.10 up to but not including 2026.7.1, a critical authorization flaw exists within the persistent memory dreaming subsystem. This vulnerability stems from insufficient access control checks when processing specific commands related to the Memory Core's dreaming behavior. Specifically, the system fails to verify whether the user issuing the command is the designated owner of the gateway instance before allowing modifications to this state.
The technical nature of this flaw allows an authorized but non-owner sender operating through an external channel to execute persistent memory control commands. By sending the /dreaming on or /dreaming off directives, these unauthorized users can alter the operational mode of the Gateway's Memory Core. This capability enables them to disable background memory processing or re-enable durable memory promotion features that the legitimate owner had intentionally disabled for security or performance reasons. While read-only status queries and help commands remain protected by standard command policies, the ability to toggle this core functionality represents a significant bypass of intended administrative controls.
The operational impact of this vulnerability is multifaceted, affecting confidentiality, integrity, and availability depending on how the stored conversation material and subsequent memory usage are configured within the specific deployment environment. Disabling background processing may lead to data loss or incomplete context retention for ongoing conversations, impacting availability and consistency. Conversely, re-enabling durable memory promotion when it was intended to be off could expose sensitive historical interactions that were meant to remain ephemeral or restricted, thereby compromising confidentiality. The integrity of the agent's operational state is also undermined as external actors can manipulate core behavioral settings without proper authorization.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically where a user lacks necessary privileges for an action but is still allowed to perform it due to flawed logic in access control checks. From the perspective of adversary tactics, this behavior mirrors techniques found in MITRE ATT&CK under privilege escalation or defense evasion categories, as attackers can manipulate system states to avoid detection or maintain persistence by controlling how memory and context are handled over time. The flaw essentially grants a lower-privileged user administrative-level influence over critical subsystem configurations.
The issue has been resolved in version 2026.7.1 of OpenClaw, which implements proper owner verification for these specific commands. For organizations unable to immediately upgrade, a recommended workaround is to disable dreaming commands entirely within external channels or to strictly restrict channel command access so that only owners can interact with the gateway's configuration endpoints. This mitigation ensures that even if an attacker gains authorized access through other means, they cannot exploit this specific pathway to alter memory processing behaviors. Regular auditing of npm dependencies and prompt application of security patches are essential practices for maintaining the integrity of agent-based systems relying on such gateways.