CVE-2026-100543

OpenClaw (npm package openclaw) before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. When the Gateway password had low entropy and the remaining configuration values were reconstructable, these hashes acted as offline password verifiers: a caller able to obtain the redacted configuration (for example via config.get) could test password candidates offline without going through the rate-limited Gateway authentication path. Recovering the password could grant the documented shared-secret operator authority. Secret references were not affected in the same way. The issue is fixed in 2026.8.1.

• CWE-200

• https://github.com/openclaw/openclaw/security/advisories/GHSA-qgj5-6x35-9g6f
• https://www.vulncheck.com/advisories/openclaw-before-2026.8.1-information-disclosure-via-configuration-hash

Published

Sep 26, 2026

Last Modified

Sep 26, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100538OpenClaw (npm package 'openclaw') before 2026.8.1 does not a…6.5
• CVE-2026-100539OpenClaw (npm package 'openclaw') before 2026.8.1 fails to r…2.6
• CVE-2026-10054In affected versions of Eclipse Theia (1.8.1 and later), the…8.8
• CVE-2026-100540OpenClaw Feishu before 2026.8.1 fails to validate whether a …6.8
• CVE-2026-100541OpenClaw's Matrix integration (npm package @openclaw/matrix)…7.5
• CVE-2026-100542OpenClaw (npm package 'openclaw') versions >= 2026.5.28 and …3.1
• CVE-2026-100544openclaw's @openclaw/voice-call package before 2026.8.1 laun…8.8
• CVE-2026-100545OpenClaw (npm package `openclaw`) before 2026.8.1 incorrectl…5.3
• CVE-2026-100546OpenClaw (npm package `openclaw`) versions >= 2026.7.2 and <…6.4
• CVE-2026-100547OpenClaw is a coding agent distributed as the npm package `o…5.5
• CVE-2026-100548OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and …5.3
• CVE-2026-100549OpenClaw versions before 2026.8.1 contain a path traversal v…5.4