CVE-2026-100578

OpenClaw (npm package `openclaw`) before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, a write-scoped non-owner caller can start a chat turn whose tool inventory includes the `gateway` and `cron` tools, causing the agent to invoke owner-only configuration or scheduling operations, including persistent state changes. Practical impact depends on the tools selected by the model and the caller's ability to steer the turn. Shared-secret token and password callers are treated as fully trusted operators under OpenClaw's security model and are outside the scope of this issue. The issue is fixed in 2026.7.1; as a workaround, restrict chat.send to administrators in identity-bearing deployments and remove `gateway` and `cron` from affected agent tool policies.

• CWE-269

• https://github.com/openclaw/openclaw/security/advisories/GHSA-qw7m-h363-33qw
• https://www.vulncheck.com/advisories/openclaw-before-2026.7.1-authorization-bypass-via-chat-send

Published

Sep 26, 2026

Last Modified

Sep 26, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100572OpenClaw versions >= 2026.3.25 and < 2026.8.1 apply invalid-…5.3
• CVE-2026-100573OpenClaw versions before 2026.8.1 contain a sandbox policy b…3.3
• CVE-2026-100574OpenClaw (npm package 'openclaw') before 2026.8.1 contains a…5.9
• CVE-2026-100575OpenClaw Slack versions before 2026.8.1 fail to properly enf…8.8
• CVE-2026-100576OpenClaw versions before 2026.8.1 contain a server-side requ…5.4
• CVE-2026-100577OpenClaw versions before 2026.8.1 fail to validate video ass…6.3
• CVE-2026-100579OpenClaw (npm package 'openclaw') before 2026.7.1 incorrectl…7.6
• CVE-2026-10058ITS Intelligent SCADA System developed by ITP Technology has…4.8
• CVE-2026-100580OpenClaw (npm package 'openclaw') before 2026.7.1 improperly…8.8
• CVE-2026-100581OpenClaw for iOS before 2026.8.11 stores Gateway credentials…5.5
• CVE-2026-100582OpenClaw channel plugins (@openclaw/msteams, @openclaw/feish…6.5
• CVE-2026-100583OpenClaw Discord versions before 2026.7.1 contain an authori…4.3