CVE-2026-100578
Received Received - Intake

OpenClaw Privilege Escalation via Chat Tool Exposure

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
OpenClaw (npm package `openclaw`) before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, a write-scoped non-owner caller can start a chat turn whose tool inventory includes the `gateway` and `cron` tools, causing the agent to invoke owner-only configuration or scheduling operations, including persistent state changes. Practical impact depends on the tools selected by the model and the caller's ability to steer the turn. Shared-secret token and password callers are treated as fully trusted operators under OpenClaw's security model and are outside the scope of this issue. The issue is fixed in 2026.7.1; as a workaround, restrict chat.send to administrators in identity-bearing deployments and remove `gateway` and `cron` from affected agent tool policies.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100578
EUVD
EUVD-2026-87473

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openclaw openclaw to 2026.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenClaw before version 2026.7.1 has a flaw in the chat.send endpoint that allows non-owner callers with write scope to access owner-only tools like gateway and cron. This happens in deployments where caller identity and operator scopes are enforced. The issue enables unauthorized execution of configuration or scheduling operations, leading to persistent state changes.

Detection Guidance

To detect this vulnerability, check the version of the openclaw npm package installed on your system. Run: npm list openclaw. If the version is below 2026.7.1, the system is vulnerable. Additionally, review agent tool policies to confirm if gateway and cron tools are present and accessible via chat.send endpoints.

Impact Analysis

The impact depends on the tools selected by the model and the caller's ability to steer the conversation. It can lead to unauthorized configuration changes or scheduling operations, including persistent state modifications. The vulnerability requires low privileges and no user interaction, making it exploitable with minimal access.

Compliance Impact

The vulnerability could lead to unauthorized configuration changes or scheduling operations, which may violate compliance requirements for data protection and access controls in standards like GDPR and HIPAA. Unauthorized persistent state changes could result in improper handling of sensitive data, affecting confidentiality and integrity.

Mitigation Strategies

Immediately upgrade the openclaw package to version 2026.7.1 or later using: npm install openclaw@2026.7.1. As a temporary workaround, restrict chat.send access to administrators and remove gateway and cron tools from agent tool policies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100578. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart