CVE-2026-100594 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the /export-trajectory endpoint that allows non-owner senders to request and receive owner-only trajectory bundles. Attackers can access prompts, model messages, tool schemas, runtime events, and local path metadata from affected sessions by exploiting insufficient authorization checks.
If you want to get best quality of vulnerability data, you may have to visit VulDB.