CVE-2026-100529
Received Received - Intake

Authorization Bypass in OpenClaw File-Transfer

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access sibling paths or different nodes beyond the operator's original approval scope.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100529
EUVD
EUVD-2026-87521

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openclaw openclaw to 2026.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenClaw versions before 2026.8.1 have an authorization scope widening vulnerability in file-transfer allow-always approvals. Attackers can exploit this by reusing standing grants for unreviewed paths through glob metacharacter interpretation and node display name reuse. This allows access to sibling paths or different nodes beyond the original approval scope.

Detection Guidance

Check OpenClaw versions before 2026.8.1 using package managers like npm list openclaw or by inspecting version files. Review file-transfer approval logs for allow-always grants with glob metacharacters or reused node display names. Look for unauthorized access to sibling paths or nodes outside approved scopes.

Impact Analysis

Attackers with prior operator approval could gain unauthorized access to read or write files beyond the intended scope. This could lead to data breaches, unauthorized modifications, or exposure of sensitive information if the system handles confidential data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Upgrade OpenClaw to version 2026.8.1 or later immediately. Avoid using allow-always approvals for glob metacharacters. Ensure node display names are unique to prevent path confusion. Recreate all standing grants after upgrading to invalidate any widened scopes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100529. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart