CVE-2026-100593 in Openclaw
Summary
by MITRE • 09/26/2026
OpenClaw (npm package `openclaw`) before 2026.7.1 does not enforce the documented owner-only requirement for persistent `/activation` policy changes in group channels. An authorized non-owner channel sender can change whether the agent requires mention-based activation, causing the agent to respond more broadly in the group (exposing its responses to additional group traffic) or suppressing expected activation behavior until an owner restores the intended setting. The issue is fixed in version 2026.7.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified within the OpenClaw npm package prior to version 2026.7.1 represents a critical failure in access control mechanisms, specifically concerning the enforcement of role-based permissions for persistent configuration changes. In secure software design, administrative or state-altering actions must be strictly bound to authorized roles, typically restricted to channel owners or administrators who bear responsibility for the group's operational integrity. However, this implementation flaw allows any authenticated user with send privileges in a group channel to modify the agent’s activation policy without verifying ownership status. This deficiency directly contradicts the documented security model which mandates that only owners can alter persistent settings such as whether the AI agent requires mention-based activation. By bypassing these checks, non-owner participants gain unauthorized control over how the agent behaves within the shared communication space.
From a technical perspective, this issue is classified under CWE-862 Missing Authorization, where the application fails to verify that the user has the necessary privileges for the requested action. The specific mechanism involves the `/activation` endpoint or command handler not validating the requester’s role against the channel owner list before persisting changes to the configuration database. This allows an attacker who is merely a participant in a group chat to toggle the agent into modes where it responds broadly to all messages rather than only when explicitly mentioned, or conversely suppress expected activation behaviors entirely. Such manipulation disrupts the intended operational logic of the bot and can lead to significant information leakage as responses meant for specific users are broadcasted to the entire channel audience.
The operational impact of this vulnerability extends beyond simple configuration disruption. When an agent is forced into a broad-response mode, it may process and reveal sensitive data or internal reasoning processes in response to general chat traffic that was not intended for public consumption. This exposure can lead to unintended disclosure of proprietary information, user-specific context, or other confidential details embedded within the conversation flow. Furthermore, if the activation behavior is suppressed, legitimate users may be unable to interact with the agent effectively, leading to a denial of service condition specific to the functionality rather than the infrastructure. The persistence of these changes means that the disruption continues until an owner manually intervenes to restore the correct settings, creating ongoing operational friction and potential security risks during the window of unauthorized modification.
In terms of threat modeling, this vulnerability aligns with MITRE ATT&CK techniques related to Defense Evasion and Impact, specifically involving manipulation of application configuration or behavior for malicious intent. While often exploited by insiders or compromised accounts rather than external attackers directly targeting authentication bypasses, it highlights a fundamental weakness in the principle of least privilege within the group channel architecture. The ability to alter persistent state without proper authorization undermines trust in the platform’s security guarantees and can be leveraged as part of a broader attack chain to degrade service quality or exfiltrate data through increased response volume.
To mitigate this risk, organizations using OpenClaw must immediately upgrade to version 2026.7.1 where these access control checks have been properly implemented. Until the update is applied, administrators should monitor channel activity for unexpected changes in agent behavior and restrict send permissions to trusted individuals if possible. Additionally, implementing audit logging for configuration changes can help detect unauthorized modifications post-upgrade or during transitional periods. It is also advisable to review other endpoints within the package that modify persistent state to ensure similar authorization checks are consistently enforced across all administrative functions, thereby closing potential gaps in the overall security posture of the application.