CVE-2026-100599 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In deployments with the Google Meet plugin enabled, a paired Chrome node, and the googlemeet.chrome node command allowed, a tool-enabled agent able to invoke that command can execute attacker-selected processes on the paired node, impacting files, credentials, browser profiles, and availability on that node. The issue is fixed in 2026.7.1; as a workaround, remove googlemeet.chrome from allowed node commands or disable the Google Meet plugin.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/26/2026
OpenClaw versions ranging from 2026.5.1 through 2026.7.0 contain a critical security flaw related to command execution validation on paired nodes within integrated environments. The vulnerability specifically affects the googlemeet.chrome node command, which is designed to facilitate interactions with Google Meet sessions via Chrome browsers. In these affected versions, the software fails to enforce the configured exec approval path when processing commands sent to connected nodes. This represents a significant deviation from the intended security architecture, where all system-level operations should undergo rigorous validation and authorization checks before execution. The flaw allows caller-supplied audio command arrays to be processed directly without adhering to the standard system.run approval flow that typically governs such actions in OpenClaw deployments.
The technical nature of this vulnerability can be classified under CWE-20, which describes Improper Input Validation, as well as CWE-862, Missing Authorization, because the application fails to verify whether the caller is authorized to execute specific commands on a remote node. From an offensive security perspective, this aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically where agents leverage legitimate system tools or APIs to perform malicious actions without detection by standard access controls. The core issue lies in the bypass of the central command execution gateway, allowing direct invocation of processes on paired devices through a specialized plugin interface that was not subjected to the same security scrutiny as general-purpose commands.
The operational impact of this vulnerability is severe for organizations utilizing OpenClaw with the Google Meet plugin enabled and having configured googlemeet.chrome as an allowed node command. An attacker who gains access to a tool-enabled agent within the system can exploit this flaw to execute arbitrary processes on any paired Chrome node. This capability extends beyond simple process execution; it impacts the integrity of local files, potentially leading to data exfiltration or destruction. Furthermore, because these commands operate in the context of the user session running the browser, they compromise stored credentials and sensitive browser profile data, including cookies, saved passwords, and autofill information. The ability to execute arbitrary code also poses a risk to system availability, as malicious processes can consume resources or crash applications, leading to denial-of-service conditions for end-users relying on Google Meet services.
To mitigate this vulnerability, immediate action is required if the environment relies on OpenClaw versions prior to 2026.7.1. The recommended workaround involves removing googlemeet.chrome from the list of allowed node commands in the configuration settings. This effectively disables the specific attack vector by preventing agents from invoking that particular command type. Alternatively, administrators can disable the Google Meet plugin entirely if it is not strictly necessary for business operations, thereby eliminating the code path associated with this flaw until an upgrade to version 2026.7.1 or later is performed. Upgrading to the patched version resolves the issue by ensuring that all node commands, including those related to Google Meet integrations, correctly apply the configured exec approval paths and undergo proper authorization checks before execution on paired nodes.