CVE-2026-100548
Received Received - Intake

OpenClaw npm Package Credential Exposure via Embedding Failover

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 contain a credential exposure issue in memory embedding failover. When remote embedding fallback is configured and the primary embedding provider fails, the request can be sent to a different fallback provider while still reusing the primary provider's configured API key, causing that credential to be transmitted as a bearer token to an unintended vendor. The practical impact depends on the configured providers, whether failover occurs, and the privileges attached to the primary provider key. The issue is fixed in 2026.8.1; as a workaround, disable cross-provider embedding fallback or configure each provider with separate, narrowly scoped credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100548
EUVD
EUVD-2026-87502

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the npm package 'openclaw' versions between 2026.3.28 and 2026.8.0. When remote embedding fallback is enabled and the primary provider fails, the system may send requests to a fallback provider while reusing the primary provider's API key as a bearer token. This unintentionally transmits credentials to an unauthorized vendor.

Detection Guidance

Check if your OpenClaw version is between 2026.3.28 and 2026.8.0. Review configuration files for remote embedding fallback settings. Monitor network traffic for unexpected bearer token transmissions to unintended providers.

Impact Analysis

The impact depends on provider configurations, whether failover occurs, and the privileges of the primary provider key. If failover happens, sensitive credentials meant for one vendor could be exposed to another. This could lead to unauthorized access or misuse of the exposed API key.

Compliance Impact

This vulnerability could lead to unauthorized transmission of credentials to unintended vendors during failover scenarios. This may result in non-compliance with GDPR's data protection requirements (Article 32) regarding secure processing and confidentiality, and HIPAA's safeguards for protecting electronic protected health information (ePHI) if the exposed credentials grant access to sensitive data.

Mitigation Strategies

Upgrade OpenClaw to version 2026.8.1 or later. Disable cross-provider embedding fallback in configuration. Assign separate, narrowly scoped credentials to each provider to limit exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100548. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart