CVE-2026-100536
Last modified
CVE-2026-100536 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. OpenClaw versions before 2026.8.1 fail to validate all source fields in structured message attachments, allowing attackers to hide unvalidated host paths behind allowed attachment sources. Attackers can exploit this by providing multiple source fields to bypass sandbox path validation and cause Telegram delivery to read and send known host files that would otherwise be rejected..
Description
OpenClaw versions before 2026.8.1 fail to validate all source fields in structured message attachments, allowing attackers to hide unvalidated host paths behind allowed attachment sources. Attackers can exploit this by providing multiple source fields to bypass sandbox path validation and cause Telegram delivery to read and send known host files that would otherwise be rejected.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| OpenClaw | OpenClaw | < 2026.8.1 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-100536?
How severe is CVE-2026-100536?
How do I fix CVE-2026-100536?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-100530OpenClaw versions before 2026.8.1 fail to bind working direc…7.3
- CVE-2026-100531The @openclaw/slack npm package before 2026.8.1 contains an …6.5
- CVE-2026-100532@openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsAp…8.1
- CVE-2026-100533OpenClaw versions before 2026.8.1 contain a path traversal v…5.3
- CVE-2026-100534OpenClaw versions before 2026.8.1 contain an authorization b…3.1
- CVE-2026-100535OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and <…7.5
- CVE-2026-100537OpenClaw (npm package 'openclaw') before 2026.8.1 fails to a…3.1
- CVE-2026-100538OpenClaw (npm package 'openclaw') before 2026.8.1 does not a…6.5
- CVE-2026-100539OpenClaw (npm package 'openclaw') before 2026.8.1 fails to r…2.6
- CVE-2026-10054In affected versions of Eclipse Theia (1.8.1 and later), the…8.8
- CVE-2026-100540OpenClaw Feishu before 2026.8.1 fails to validate whether a …6.8
- CVE-2026-100541OpenClaw's Matrix integration (npm package @openclaw/matrix)…7.5
Are you affected by CVE-2026-100536?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST