CVE-2026-100596 in OpenClaw
Riassunto
di MITRE • 26/09/2026
OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Attackers can persist arbitrary stdio MCP commands that execute with OpenClaw process privileges when configuration loads, compromising host confidentiality, integrity, and availability.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.